WordPress plugin
Classified Listing – AI-Powered Classified ads & Business Directory security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 33 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High8
- Medium25
- Low0
All Classified Listing – AI-Powered Classified ads & Business Directory vulnerabilities
- High8.8Authenticated (Subscriber+) Arbitrary PHP Code Execution
≤6.1.5Update to 6.2.0
- Medium4.3Missing Authorization
<6.1.1Update to 6.1.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤6.1.2Update to 6.1.3
- High7.2Unauthenticated Stored Cross-Site Scripting
≤6.1.3Update to 6.1.5
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
≤6.1.0Update to 6.1.1
- Medium4.3Missing Authorization
≤6.1.3Update to 6.1.5
- Medium4.3Missing Authorization
≤5.4.3Update to 5.4.4
- Medium4.3Missing Authorization
≤5.4.3Update to 5.4.4
- Medium4.3Missing Authorization
≤5.4.2Update to 5.4.3
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Receipt Disclosure
≤5.3.8Update to 5.3.9
- High7.2Unauthenticated Stored Cross-Site Scripting
≤5.4.2Update to 5.4.3
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Feature Modification via Multiple AJAX Handlers ('listingId'/'id' Parameters)
≤5.4.2Update to 5.4.3
- Medium4.3Authenticated (Subscriber+) Arbitrary File Download
≤5.3.8Update to 5.3.9
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via add_order_note and send_email_to_user_by_moderator AJAX Actions
≤5.3.10Update to 5.4.0
- Medium4.3Missing Authorization
≤5.3.9Update to 5.3.10
- High7.2Unauthenticated Stored Cross-Site Scripting
≤5.3.8Update to 5.3.9
- Medium5.3Missing Authorization
≤5.3.8Update to 5.3.9
- Medium4.3Authenticated (Subscriber+) Sensitive Data Exposure
≤5.3.4Update to 5.3.5
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via Listing Description
≤5.0.3Update to 5.0.4
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Listing Types Tampering
≤5.2.0Update to 5.2.1
- Medium4.3Missing Authorization
≤5.0.6Update to 5.0.7
- Medium4.3Authenticated (Contributor+) Content Injection
≤5.0.0Update to 5.0.1
- High8.8Authenticated (Contributor+) Local File Inclusion
≤4.2.0Update to 4.2.1
- Medium5.3Unauthenticated Settings Exposure
≤4.0.4Update to 4.0.5
- High8.8Authenticated (Subscriber+) Limited Arbitrary Option Update
≤3.1.15.1Update to 3.1.16
- High8.8Authenticated (Contributor+) Local File Inclusion
≤3.1.16Update to 3.1.17
- Medium6.1Reflected Cross-Site Scripting
≤4.0.1Update to 4.0.2
- Medium6.3Missing Authorization
≤3.1.7Update to 3.1.8
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion
≤3.0.10.3Update to 3.0.11
- Medium6.5Missing Authorization
≤3.0.4Update to 3.0.5
- High8.8Cross-Site Request Forgery to Account Takeover via rtcl_update_user_account
≤3.0.4Update to 3.0.5
- Medium4.3Cross-Site Request Forgery via rtcl_ajax_thumbnail_delete
≤2.4.5Update to 2.4.6
- Medium6.1Reflected Cross-Site Scripting
<2.2.14Update to 2.2.14
Classified Listing – AI-Powered Classified ads & Business Directory: common questions
Does Classified Listing – AI-Powered Classified ads & Business Directory have known vulnerabilities?
Yes. VulnCrest Radar lists 33 known vulnerabilities in Classified Listing – AI-Powered Classified ads & Business Directory: 8 high, 25 medium. None are known to affect version null.
How do I check which version of Classified Listing – AI-Powered Classified ads & Business Directory I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Classified Listing – AI-Powered Classified ads & Business Directory vulnerability?
CVE-2026-111828, published Oct 19, 2026: Classified Listing – AI-Powered Classified ads & Business Directory <= 6.1.5 - Authenticated (Subscriber+) Arbitrary PHP Code Execution. Severity: High (CVSS 8.8).
Is any Classified Listing – AI-Powered Classified ads & Business Directory vulnerability listed in CISA KEV?
No. None of the known Classified Listing – AI-Powered Classified ads & Business Directory vulnerabilities is currently listed in the CISA KEV catalog.