Medium
CVE-2026-27391
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 27
Reset filters
Medium
CVE-2026-27392
Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization
Medium
CVE-2026-28078
Directory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Editor+) Arbitrary File Download
Medium
CVE-2026-28138
uListing <= 2.2.0 - Authenticated (Administrator+) PHP Object Injection
High
CVE-2025-32662
uListing <= 2.2.0 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2025-32122
uListing <= 2.1.9 - Authenticated (Administrator+) SQL Injection
High
CVE-2025-1653
Directory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation
High
CVE-2025-1657
Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injection
Medium
CVE-2025-25151
uListing <= 2.1.6 - Authenticated (Contributor+) SQL Injection
High
CVE-2025-25150
uListing <= 2.1.6 - Unauthenticated SQL Injection
Critical
CVE-2021-4340
uListing <= 1.6.6 - Unauthenticated SQL Injection
High
284b9b04-aa8f-41ff-b944-3488c5da8e20
Listing, Classified Ads & Business Directory – uListing <= 2.0.8 - Cross-Site Request Forgery
Critical
CVE-2021-36879
Listing, Classified Ads & Business Directory – uListing <= 2.0.5 - Privilege Escalation
Medium
CVE-2021-36878
uListing <= 2.0.5 - Cross-Site Request Forgery leading to Settings Change
Medium
CVE-2021-36877
Listing, Classified Ads & Business Directory – uListing <= 2.0.5 - Cross-Site Request Forgery
Medium
CVE-2021-36876
Listing, Classified Ads & Business Directory – uListing <= 2.0.5 - Cross-Site Request Forgery
Medium
CVE-2021-36875
Listing, Classified Ads & Business Directory – uListing <= 2.0.5 - Reflected Cross-Site Scripting
High
CVE-2021-36874
uListing plugin <= 2.0.5 - Authenticated Insecure Direct Object References (IDOR)
Critical
CVE-2021-36880
Listing, Classified Ads & Business Directory – uListing <= 2.0.3 - Unauthenticated SQL Injection
Critical
CVE-2021-4381
uListing <= 1.6.6 - Unauthenticated Options Changes via wp_route
Critical
CVE-2021-4370
uListing <= 1.6.6 - Missing Authorization
Critical
CVE-2021-4357
uListing <= 1.6.6 - Unauthenticated Arbitrary Post/Page Deletion
Medium
CVE-2021-4345
uListing <= 1.6.6 - Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion
Critical
CVE-2021-4346
uListing <= 1.6.6 - Unauthenticated Arbitrary Account Changes
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.