Classified Listing
by WordPress
Source repositories
CVEs (28)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-7563 | Med | 0.21 | 4.3 | 0.00 | May 15, 2026 | The Classified Listing – AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 5.3.10. This is due to the plugin not properly verifying that a user is authorized to perform an… | ||
| CVE-2025-12953 | Med | 0.21 | 4.3 | 0.00 | Nov 11, 2025 | The Classified Listing – AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the "rtcl_ajax_add_listing_type", "rtcl_ajax_update_listing_type", and… | ||
| CVE-2024-3893 | Med | 0.21 | 4.3 | 0.00 | Apr 25, 2024 | The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the rtcl_fb_gallery_image_delete AJAX action in all versions up to, and including, 3.0.10.3. This makes it… | ||
| CVE-2026-16276 | Low | 0.00 | 2.7 | 0.00 | Aug 3, 2026 | The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted to administrators… | ||
| CVE-2026-16274 | Low | 0.00 | 2.7 | 0.00 | Aug 3, 2026 | The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site… | ||
| CVE-2026-14183 | Med | 0.00 | 4.3 | 0.00 | Jul 21, 2026 | The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with subscriber-level access to read the payment receipt details of any other user's order. | ||
| CVE-2026-57355 | Med | 0.00 | 6.5 | 0.00 | Jul 2, 2026 | Subscriber Broken Access Control in Classified Listing <= 5.4.2 versions. | ||
| CVE-2026-57344 | Hig | 0.00 | 7.1 | 0.00 | Jul 2, 2026 | Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versions. |
- risk 0.21cvss 4.3epss 0.00
The Classified Listing – AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 5.3.10. This is due to the plugin not properly verifying that a user is authorized to perform an…
- risk 0.21cvss 4.3epss 0.00
The Classified Listing – AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the "rtcl_ajax_add_listing_type", "rtcl_ajax_update_listing_type", and…
- risk 0.21cvss 4.3epss 0.00
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the rtcl_fb_gallery_image_delete AJAX action in all versions up to, and including, 3.0.10.3. This makes it…
- risk 0.00cvss 2.7epss 0.00
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted to administrators…
- risk 0.00cvss 2.7epss 0.00
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site…
- risk 0.00cvss 4.3epss 0.00
The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with subscriber-level access to read the payment receipt details of any other user's order.
- risk 0.00cvss 6.5epss 0.00
Subscriber Broken Access Control in Classified Listing <= 5.4.2 versions.
- risk 0.00cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versions.
Page 2 of 2