WordPress plugin
Directory Listings WordPress plugin – uListing security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical9
- High8
- Medium13
- Low0
All Directory Listings WordPress plugin – uListing vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.5 | Unauthenticated SQL Injection ≤2.2.0No patch available | CVE-2026-62031 | |
| Medium4.3 | Missing Authorization to Settings Update ≤2.2.0No patch available | CVE-2026-62033 | |
| Medium4.3 | Missing Authorization ≤2.2.0No patch available | CVE-2026-27391 | |
| Medium4.3 | Missing Authorization ≤2.2.0No patch available | CVE-2026-27392 | |
| Medium4.9 | Authenticated (Editor+) Arbitrary File Download ≤2.2.0No patch available | CVE-2026-28078 | |
| Medium6.6 | Authenticated (Administrator+) PHP Object Injection ≤2.2.0No patch available | CVE-2026-28138 | |
| High8.8 | Authenticated (Subscriber+) PHP Object Injection ≤2.2.0No patch available | CVE-2025-32662 | |
| Medium4.9 | Authenticated (Administrator+) SQL Injection ≤2.1.9No patch available | CVE-2025-32122 | |
| High8.8 | Authenticated (Subscriber+) Privilege Escalation ≤2.2.0No patch available | CVE-2025-1653 | |
| High8.8 | Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injection ≤2.2.0No patch available | CVE-2025-1657 | |
| Medium6.5 | Authenticated (Contributor+) SQL Injection ≤2.1.6Update to 2.1.7 | CVE-2025-25151 | |
| High7.5 | Unauthenticated SQL Injection ≤2.1.6Update to 2.1.7 | CVE-2025-25150 | |
| Medium5.3 | Unauthenticated Information Exposure ≤2.1.5Update to 2.1.6 | CVE-2024-47344 | |
| Critical9.8 | Unauthenticated SQL Injection <1.7Update to 1.7 | CVE-2021-4340 | |
| High8.8 | Cross-Site Request Forgery ≤2.0.8Update to 2.0.9 | — | |
| Critical9.8 | Privilege Escalation ≤2.0.5Update to 2.0.6 | CVE-2021-36879 | |
| Medium4.3 | Cross-Site Request Forgery leading to Settings Change ≤2.0.5Update to 2.0.6 | CVE-2021-36878 | |
| Medium6.5 | Cross-Site Request Forgery ≤2.0.5Update to 2.0.6 | CVE-2021-36877 | |
| Medium5.4 | Cross-Site Request Forgery ≤2.0.5Update to 2.0.6 | CVE-2021-36876 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤2.0.5Update to 2.0.6 | CVE-2021-36875 | |
| High7.1 | Authenticated Insecure Direct Object References (IDOR) ≤2.0.5Update to 2.0.6 | CVE-2021-36874 | |
| Critical9.8 | Unauthenticated SQL Injection ≤2.0.3Update to 2.0.4 | CVE-2021-36880 | |
| Critical9.8 | Unauthenticated Options Changes via wp_route <1.7Update to 1.7 | CVE-2021-4381 | |
| High7.5 | Unauthenticated Information Disclosure <1.7Update to 1.7 | CVE-2021-4339 | |
| Critical9.8 | Unauthenticated Wordpress Options Changes via AJAX <1.7Update to 1.7 | CVE-2021-4341 | |
| Critical9.8 | Unauthenticated Arbitrary Account Creation <1.7Update to 1.7 | CVE-2021-4343 | |
| Critical9.8 | Unauthenticated Arbitrary Account Changes <1.7Update to 1.7 | CVE-2021-4346 | |
| Medium6.5 | Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion <1.7Update to 1.7 | CVE-2021-4345 | |
| Critical9.1 | Unauthenticated Arbitrary Post/Page Deletion <1.7Update to 1.7 | CVE-2021-4357 | |
| Critical9.8 | Missing Authorization <1.7Update to 1.7 | CVE-2021-4370 |
- High7.5Unauthenticated SQL Injection
≤2.2.0No patch available
- Medium4.3Missing Authorization to Settings Update
≤2.2.0No patch available
- Medium4.3Missing Authorization
≤2.2.0No patch available
- Medium4.3Missing Authorization
≤2.2.0No patch available
- Medium4.9Authenticated (Editor+) Arbitrary File Download
≤2.2.0No patch available
- Medium6.6Authenticated (Administrator+) PHP Object Injection
≤2.2.0No patch available
- High8.8Authenticated (Subscriber+) PHP Object Injection
≤2.2.0No patch available
- Medium4.9Authenticated (Administrator+) SQL Injection
≤2.1.9No patch available
- High8.8Authenticated (Subscriber+) Privilege Escalation
≤2.2.0No patch available
- High8.8Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injection
≤2.2.0No patch available
- Medium6.5Authenticated (Contributor+) SQL Injection
≤2.1.6Update to 2.1.7
- High7.5Unauthenticated SQL Injection
≤2.1.6Update to 2.1.7
- Medium5.3Unauthenticated Information Exposure
≤2.1.5Update to 2.1.6
- Critical9.8Unauthenticated SQL Injection
<1.7Update to 1.7
- High8.8Cross-Site Request Forgery
≤2.0.8Update to 2.0.9
- Critical9.8Privilege Escalation
≤2.0.5Update to 2.0.6
- Medium4.3Cross-Site Request Forgery leading to Settings Change
≤2.0.5Update to 2.0.6
- Medium6.5Cross-Site Request Forgery
≤2.0.5Update to 2.0.6
- Medium5.4Cross-Site Request Forgery
≤2.0.5Update to 2.0.6
- Medium6.1Reflected Cross-Site Scripting
≤2.0.5Update to 2.0.6
- High7.1Authenticated Insecure Direct Object References (IDOR)
≤2.0.5Update to 2.0.6
- Critical9.8Unauthenticated SQL Injection
≤2.0.3Update to 2.0.4
- Critical9.8Unauthenticated Options Changes via wp_route
<1.7Update to 1.7
- High7.5Unauthenticated Information Disclosure
<1.7Update to 1.7
- Critical9.8Unauthenticated Wordpress Options Changes via AJAX
<1.7Update to 1.7
- Critical9.8Unauthenticated Arbitrary Account Creation
<1.7Update to 1.7
- Critical9.8Unauthenticated Arbitrary Account Changes
<1.7Update to 1.7
- Medium6.5Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion
<1.7Update to 1.7
- Critical9.1Unauthenticated Arbitrary Post/Page Deletion
<1.7Update to 1.7
- Critical9.8Missing Authorization
<1.7Update to 1.7
Directory Listings WordPress plugin – uListing: common questions
Does Directory Listings WordPress plugin – uListing have known vulnerabilities?
Yes. VulnCrest Radar lists 30 known vulnerabilities in Directory Listings WordPress plugin – uListing: 9 critical, 8 high, 13 medium. At least one is not fixed in the latest version.
How do I check which version of Directory Listings WordPress plugin – uListing I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Directory Listings WordPress plugin – uListing vulnerability?
CVE-2026-62031, published Oct 9, 2026: Directory Listings WordPress plugin – uListing <= 2.2.0 - Unauthenticated SQL Injection. Severity: High (CVSS 7.5).
Is any Directory Listings WordPress plugin – uListing vulnerability listed in CISA KEV?
No. None of the known Directory Listings WordPress plugin – uListing vulnerabilities is currently listed in the CISA KEV catalog.