Veille CVE

Recherche « Unknown Classified Listing »

16 CVE

Critique 0 Élevée 2 Moyenne 11 Faible 3 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Classified Listing » ✕
  1. CVE-2026-96904 5.3 Moyenne

    Unknown AWP Classifieds

    The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any listing.

  2. CVE-2026-106646 5.9 Moyenne

    Unknown Classified Listing

    The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-level account to modify, corrupt or delete media-library attachments owned by other users, including administrators.

  3. CVE-2025-15700 8.8 Élevée

    Unknown AWP Classifieds

    The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly accessible, network-shared directory and achieve remote code execution.

  4. CVE-2026-84150 5.4 Moyenne

    Unknown Directorist: AI-Powered Business Directory, Listings & Classified Ads

    The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with subscriber-level access to view and alter another user's favorites.

  5. CVE-2026-84098 6.5 Moyenne

    Unknown Directorist: AI-Powered Business Directory, Listings & Classified Ads

    The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging to other users. This is an incomplete fix of CVE-2023-1889 / CVE-2023-35052: a separate, unaddressed listing-deletion path allows the same impact, from at least version 3.1.0 through the current release.

  6. CVE-2026-84046 5.0 Moyenne

    Unknown Directorist: AI-Powered Business Directory, Listings & Classified Ads

    The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses.

  7. CVE-2026-84027 4.3 Moyenne

    Unknown Directorist: AI-Powered Business Directory, Listings & Classified Ads

    The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and attribute them to other users.

  8. CVE-2026-84026 5.3 Moyenne

    Unknown Directorist: AI-Powered Business Directory, Listings & Classified Ads

    The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not restrict access to a REST endpoint that returns user records, allowing unauthenticated attackers to read registered users' private contact details.

  9. CVE-2026-77766 4.3 Moyenne

    Unknown Directorist: AI-Powered Business Directory, Listings & Classified Ads

    The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not scope one of its REST collection endpoints to the requesting user, allowing users with a subscriber-level account to read every customer's order and payment records. Versions 8.8.1 to 8.9 are not affected. The endpoint was scoped correctly in 8.8.1 and the unscoped behaviour was reintroduced in 8.9.1.

  10. CVE-2026-84066 3.1 Faible

    Unknown Directorist: AI-Powered Business Directory, Listings & Classified Ads

    The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image metadata on posts belonging to other users.

  11. CVE-2026-16281 7.1 Élevée

    Unknown Classified Listing

    The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach files to, any listing owned by another user.

  12. CVE-2026-77757 5.4 Moyenne

    Unknown Directorist: AI-Powered Business Directory, Listings & Classified Ads

    The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files into a publicly accessible directory, and to delete them from their original location.

  13. CVE-2026-19074 5.3 Moyenne

    Unknown Advanced Classifieds & Directory Pro

    The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 (<= 3.4.2) is vulnerable to unauthenticated sensitive information exposure via the AJAX action `acadp_public_custom_fields_listings`.

  14. CVE-2026-16276 2.7 Faible

    Unknown Classified Listing

    The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted to administrators and report managers.

  15. CVE-2026-16274 2.7 Faible

    Unknown Classified Listing

    The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts, pending, and private posts owned by other users — regardless of ownership.

  16. CVE-2026-14183 4.3 Moyenne

    Unknown Classified Listing

    The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with subscriber-level access to read the payment receipt details of any other user's order.