WordPress security by component
uListing
Plugin description
uListing is a WordPress component with 27 published CVE records in this archive. The latest tracked vulnerability was published Jul 23, 2026; the highest CVE/CNA score is 9.8.
Plugin slug:
ulistingLatest vulnerability
CVE-2026-27392: uListing: A security weakness
uListing is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 2.2.0.
| Safe version |
|
||
|---|---|---|---|
| Jul 23, 2026 |
CVE-2026-27392
uListing: A security weakness
uListing is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 2.2.0.
|
> 2.2.0 |
CVE4.3
NVDPending
|
| Jul 23, 2026 |
CVE-2026-27391
uListing: A security weakness
uListing is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 2.2.0.
|
> 2.2.0 |
CVE5.4
NVDPending
|
| Mar 05, 2026 |
CVE-2026-28078
uListing: Filesystem traversal
uListing is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE4.9
NVDPending
|
| Feb 26, 2026 |
CVE-2026-28138
uListing: Code execution
uListing is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE7.2
NVDPending
|
| Apr 17, 2025 |
CVE-2025-32662
uListing: Code execution
uListing is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE8.8
NVDPending
|
| Apr 04, 2025 |
CVE-2025-32122
uListing: SQL injection
uListing is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE7.6
NVDPending
|
| Mar 15, 2025 |
CVE-2025-1657
Directory Listings: Code execution
Directory Listings is affected by code execution. Exploitation requires at least subscriber-level access. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE8.8
NVD8.8
|
| Mar 15, 2025 |
CVE-2025-1653
Directory Listings: Privilege escalation or authentication bypass
Directory Listings is affected by privilege escalation or authentication bypass. Exploitation requires at least subscriber-level access. A successful request can grant permissions or access that the caller should not possess.
|
See mitigation notes |
CVE8.8
NVDPending
|
| Mar 03, 2025 |
CVE-2025-25150
uListing: SQL injection
uListing is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE9.3
NVDPending
|
| Feb 07, 2025 |
CVE-2025-25151
uListing: SQL injection
uListing is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE8.5
NVDPending
|
| Oct 07, 2024 |
CVE-2024-47344
uListing: A security weakness
uListing is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Jun 07, 2023 |
CVE-2021-4381
uListing: A security weakness
uListing is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE9.8
NVD9.8
|
| Jun 07, 2023 |
CVE-2021-4370
uListing: A security weakness
uListing is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE9.8
NVD9.8
|
| Jun 07, 2023 |
CVE-2021-4357
uListing: A security weakness
uListing is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE9.1
NVD5.3
|
| Jun 07, 2023 |
CVE-2021-4346
uListing: A security weakness
uListing is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE9.8
NVD7.5
|
| Jun 07, 2023 |
CVE-2021-4345
uListing: A security weakness
uListing is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE6.5
NVD5.3
|
| Jun 07, 2023 |
CVE-2021-4343
Unauthenticated Account Creation: A security weakness
Unauthenticated Account Creation is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE9.8
NVD9.8
|
| Jun 07, 2023 |
CVE-2021-4341
uListing: A security weakness
uListing is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE9.8
NVD9.8
|
| Jun 07, 2023 |
CVE-2021-4340
uListing: SQL injection
uListing is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE9.8
NVD7.5
|
| Jun 07, 2023 |
CVE-2021-4339
uListing: A security weakness
uListing is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE7.5
NVD5.3
|
| Sep 27, 2021 |
CVE-2021-36880
Ulisting: SQL injection
Ulisting is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE8.6
NVD9.8
|
| Sep 27, 2021 |
CVE-2021-36879
Ulisting: Privilege escalation or authentication bypass
Ulisting is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.
|
See mitigation notes |
CVE9.8
NVD9.8
|
| Sep 27, 2021 |
CVE-2021-36877
Ulisting: Cross-site request forgery
Ulisting is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE4.3
NVD6.5
|
| Sep 27, 2021 |
CVE-2021-36876
Ulisting: Cross-site request forgery
Ulisting is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE5.4
NVD8.8
|
| Sep 27, 2021 |
CVE-2021-36875
Directory Listings WordPress plugin – uListing: Cross-site scripting
Directory Listings WordPress plugin – uListing is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.9
NVD4.8
|
| Sep 27, 2021 |
CVE-2021-36874
Ulisting: A security weakness
Ulisting is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE7.1
NVD8.8
|
| Sep 27, 2021 |
CVE-2021-36878
Ulisting: Cross-site request forgery
Ulisting is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE4.3
NVD4.3
|