CVE-2024-13753

CVE-2024-13753 — The Ultimate Classified Listings WordPress plugin is vulnerable to Cross-Site Request Forgery in all versions up to 1.4 due to missing or incorrect nonce validation on the update_profile function. This could allow unauthenticated attackers to modify a victim’s email via a forged ...

CVE-2024-13748

CVE-2024-13748 — Ultimate Classified Listings for WordPress has a Stored XSS in the Title parameter on all versions up to 1.4. Exploitation requires administrator-level access and affects multisite or sites with unfiltered_html disabled. Wordfence reports the vulnerability as present and notes a ...