sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total33
Critical0
High9
Medium22
Reset
Showing 1-20 of 33 records
Threat Entry Updated 2026-09-08

Classified Listing - Security Vulnerability (CVE-2026-16281)

The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach files to, any listing owned by another user.

PLUGIN Classified Listing

CVE-2026-16281

HIGH CVSS 7.1 2026-09-04
Open Full Technical Breakdown
Threat Entry Updated 2026-08-26

Classified Listing - Authentication Bypass (CVE-2026-15985)

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the process_otp_login() function. This makes it possible for unauthenticated attackers to authenticate as any user with a phone number registered in the plugin's phone table by submitting an arbitrary OTP code and UID through the Firebase OTP login flow. Successful exploitation requires OTP login to be enabled with Firebase selected as the verification gateway, and requires the…

PLUGIN Classified Listing

CVE-2026-15985

HIGH CVSS 8.1 2026-08-26
Open Full Technical Breakdown
Threat Entry Updated 2026-08-26

Classified Listing - Broken Access Control (CVE-2026-16276)

The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted to administrators and report managers.

PLUGIN Classified Listing

CVE-2026-16276

LOW CVSS 2.7 2026-08-03
Open Full Technical Breakdown
Threat Entry Updated 2026-08-26

Classified Listing - Security Vulnerability (CVE-2026-16274)

The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts, pending, and private posts owned by other users — regardless of ownership.

PLUGIN Classified Listing

CVE-2026-16274

LOW CVSS 2.7 2026-08-03
Open Full Technical Breakdown
Threat Entry Updated 2026-07-21

Classified Listing - Broken Access Control (CVE-2026-14183)

The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with subscriber-level access to read the payment receipt details of any other user's order.

PLUGIN Classified Listing

CVE-2026-14183

MEDIUM CVSS 4.3 2026-07-21
Open Full Technical Breakdown
Threat Entry Updated 2026-06-22

Classified Listing - Broken Access Control (CVE-2026-10779)

The Classified Listing – Classified ads & Business Directory plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.4.2. This is due to a missing capability/ownership check on the gallery_image_update_as_feature AJAX handler (action: rtcl_fb_gallery_image_update_as_feature), which accepts a user-supplied listing ID and attachment ID and sets the featured image of a listing while only validating a nonce that is exposed to any logged-in user on the frontend listing-submission form. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the featured…

PLUGIN Classified Listing

CVE-2026-10779

MEDIUM CVSS 4.3 2026-06-19
Open Full Technical Breakdown
Threat Entry Updated 2026-07-22

Classified Listing - Path Traversal (CVE-2026-42679)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mamunur Rashid Classified Listing allows Path Traversal. This issue affects Classified Listing: from n/a through 5.3.8.

PLUGIN Classified Listing

CVE-2026-42679

MEDIUM CVSS 6.5 2026-06-01
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Classified Listing - Security Vulnerability (CVE-2026-7563)

The Classified Listing – AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 5.3.10. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to add arbitrary notes to any order and trigger unsolicited notification and moderation emails to listing owners without administrative authorization.

PLUGIN Classified Listing

CVE-2026-7563

MEDIUM CVSS 4.3 2026-05-15
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Classified Listing - Security Vulnerability (CVE-2025-7711)

The The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.

PLUGIN Classified Listing

CVE-2025-7711

MEDIUM CVSS 5.4 2025-11-17
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Classified Listing - Broken Access Control (CVE-2025-12953)

The Classified Listing – AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the "rtcl_ajax_add_listing_type", "rtcl_ajax_update_listing_type", and "rtcl_ajax_delete_listing_type" function in all versions up to, and including, 5.2.0. This makes it possible for authenticated attackers, with subscriber level access and above, to add, update, or delete listing types.

PLUGIN Classified Listing

CVE-2025-12953

MEDIUM CVSS 4.3 2025-11-11
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.