Listingpro Vulnerabilities

The ListingPro - WordPress Directory & Listing Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject...

CVSS:

6.4

Affected:

up to 2.9.11

Fixed in:

2.9.12

Disclosed:

Jun 24, 2026

CVE-2026-56046 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro listingpro allows Reflected XSS.This issue affects ListingPro: from n/a through < 2.9.10.

Affected:

up to 2.9.10

Fixed in:

2.9.10

Disclosed:

Dec 18, 2025

CVE-2025-64376 on NVD →

[en] Missing Authorization vulnerability in CridioStudio ListingPro listingpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through < 2.9.10.

Affected:

up to 2.9.10

Fixed in:

2.9.10

Disclosed:

Dec 18, 2025

CVE-2025-64378 on NVD →

[en] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CridioStudio ListingPro listingpro allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through < 2.9.10.

Affected:

up to 2.9.10

Fixed in:

2.9.10

Disclosed:

Dec 18, 2025

CVE-2025-64377 on NVD →

[en] Missing Authorization vulnerability in CridioStudio ListingPro listingpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through <= 2.9.9.

Affected:

up to 2.9.9

Fix:

No patched version reported

Disclosed:

Dec 18, 2025

CVE-2025-63039 on NVD →

[en] Missing Authorization vulnerability in CridioStudio ListingPro listingpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through <= 2.9.9.

Affected:

up to 2.9.9

Fix:

No patched version reported

Disclosed:

Dec 9, 2025

CVE-2025-63047 on NVD →

The ListingPro theme for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.9.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 2.9.9

Fix:

No patched version reported

Disclosed:

Nov 6, 2025

CVE-2025-63039 on NVD →

The ListingPro theme for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.9.9. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 2.9.9

Fix:

No patched version reported

Disclosed:

Oct 19, 2025

CVE-2025-63047 on NVD →

The ListingPro theme for WordPress is vulnerable to Local File Inclusion in versions up to 2.9.10. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitiv...

CVSS:

8.1

Affected:

up to 2.9.10

Fixed in:

2.9.10

Disclosed:

Sep 12, 2025

CVE-2025-64377 on NVD →

The ListingPro theme for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to 2.9.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into pe...

CVSS:

6.1

Affected:

up to 2.9.10

Fixed in:

2.9.10

Disclosed:

Sep 12, 2025

CVE-2025-64376 on NVD →

The ListingPro - WordPress Directory & Listing Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to 2.9.10 (exclusive). This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized a...

CVSS:

4.3

Affected:

up to 2.9.10

Fixed in:

2.9.10

Disclosed:

Sep 12, 2025

CVE-2025-64378 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in CridioStudio ListingPro allows Authentication Bypass.This issue affects ListingPro: from n/a through 2.9.4.

Affected:

up to 2.9.3

Fix:

No patched version reported

Disclosed:

Jan 2, 2025

CVE-2024-39623 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro.This issue affects ListingPro: from n/a through 2.9.4.

Affected:

up to 2.9.3

Fix:

No patched version reported

Disclosed:

Aug 29, 2024

CVE-2024-39622 on NVD →

[en] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through 2.9.3.

Affected:

up to 2.9.3

Fix:

No patched version reported

Disclosed:

Aug 1, 2024

CVE-2024-39624 on NVD →

The ListingPro theme for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.9.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into...

CVSS:

10

Affected:

up to 2.9.4

Fixed in:

2.9.5

Disclosed:

Jul 22, 2024

CVE-2024-39622 on NVD →

The ListingPro - WordPress Directory & Listing Theme theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execu...

CVSS:

8.8

Affected:

up to 2.9.4

Fixed in:

2.9.5

Disclosed:

Jul 22, 2024

CVE-2024-39624 on NVD →

The ListingPro theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.4. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to takeover user accounts via a forged request granted they can trick a site ad...

CVSS:

8.8

Affected:

up to 2.9.4

Fixed in:

2.9.5

Disclosed:

Jul 22, 2024

CVE-2024-39623 on NVD →

[en] The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the ~/listingpro-plugin/functions.php file. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, full names, email addresses, phone...

Affected:

up to 2.6.1

Fixed in:

2.6.1

Disclosed:

Jun 7, 2023

CVE-2020-36723 on NVD →

[en] The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lp_cc_addons_actions function. This makes it possible for unauthenticated attackers to arbitraril...

Affected:

up to 2.6.1

Fixed in:

2.6.1

Disclosed:

Jun 7, 2023

CVE-2020-36719 on NVD →

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lp_cc_addons_actions function. This makes it possible for unauthenticated attackers to arbitrarily ins...

CVSS:

9.8

Affected:

up to 2.6.1

Fixed in:

2.6.1

Disclosed:

Dec 17, 2020

CVE-2020-36719 on NVD →

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the ~/listingpro-plugin/functions.php file. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, full names, email addresses, phone numb...

CVSS:

5.3

Affected:

up to 2.6.1

Fixed in:

2.6.1

Disclosed:

Dec 17, 2020

CVE-2020-36723 on NVD →

Unauthenticated Sensitive Data Disclosure (usernames, emails, other data) vulnerability found by Jerome Bruandet (NinTechNet) in WordPress ListingPro theme (versions <= 2.6).

Affected:

up to 2.6.1

Fixed in:

2.6.1

Disclosed:

Dec 17, 2020

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the ~/listingpro-plugin/functions.php file. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, full names, email addresses, phone numb...

Affected:

up to 2.6.1

Fixed in:

2.6.1

Disclosed:

Dec 17, 2020

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lp_cc_addons_actions function. This makes it possible for unauthenticated attackers to arbitrarily ins...

Affected:

up to 2.6.1

Fixed in:

2.6.1

Disclosed:

Dec 17, 2020

Unauthenticated Arbitrary Plugin Installation/Activation/Deactivation vulnerability found by Jerome Bruandet (NinTechNet) in WordPress ListingPro theme (versions <= 2.6).

Affected:

up to 2.6.1

Fixed in:

2.6.1

Disclosed:

Dec 17, 2020

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Cross-Site Scripting via the 'lp_s_loc' parameter in versions up to, and including, 2.5.3 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a...

CVSS:

6.1

Affected:

up to 2.5.4

Fixed in:

2.5.4

Disclosed:

Jan 15, 2020

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Cross-Site Scripting via the 'lp_s_loc' parameter in versions up to, and including, 2.5.3 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a...

Affected:

up to 2.5.4

Fixed in:

2.5.4

Disclosed:

Jan 15, 2020

Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered by m0ze in WordPress ListingPro premium theme (versions <= 2.5.3).

Affected:

up to 2.5.4

Fixed in:

2.5.4

Disclosed:

Jan 15, 2020

[en] The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Good For field on the new listing submit page.

Affected:

up to 2.0.14.5

Fixed in:

2.0.14.5

Disclosed:

Dec 26, 2019

CVE-2019-19542 on NVD →

[en] The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Best Day/Night field on the new listing submit page.

Affected:

up to 2.0.14.5

Fixed in:

2.0.14.5

Disclosed:

Dec 26, 2019

CVE-2019-19541 on NVD →

[en] The ListingPro theme before v2.0.14.2 for WordPress has Reflected XSS via the What field on the homepage.

Affected:

up to 2.0.14.5

Fixed in:

2.0.14.5

Disclosed:

Dec 26, 2019

CVE-2019-19540 on NVD →

Reflected & Persistent Cross-Site Scripting (XSS) vulnerability found by SUBVΞRSΛ in WordPress ListingPro premium theme (versions <= 2.0.14.2).

Affected:

up to 2.0.14.5

Fixed in:

2.0.14.5

Disclosed:

Dec 13, 2019

The ListingPro theme before v2.0.14.5 for WordPress has Reflected XSS via the What field on the homepage.

CVSS:

6.1

Affected:

up to 2.0.14.5

Fixed in:

2.0.14.5

Disclosed:

Nov 29, 2019

CVE-2019-19540 on NVD →

The ListingPro theme before v2.0.14.5 for WordPress has Persistent XSS via the Best Day/Night field on the new listing submit page.

CVSS:

5.4

Affected:

up to 2.0.14.4

Fixed in:

2.0.14.5

Disclosed:

Nov 29, 2019

CVE-2019-19541 on NVD →

The ListingPro theme before v2.0.14.5 for WordPress has Persistent XSS via the Good For field on the new listing submit page.

CVSS:

5.4

Affected:

up to 2.0.14.4

Fixed in:

2.0.14.5

Disclosed:

Nov 29, 2019

CVE-2019-19542 on NVD →

Reflected XSS was discovered in the &laquo;ListingPro - WordPress Directory Theme&raquo;, tested version &mdash; v2.5.3 Edit - WPScanTeam: January 13th, 2020 - Report Received &amp; Envato Contacted January 13th, 2020 - Envato Investigating January 15th, 2020 - Theme updated, v2.5.4, fixing the issue

Affected:

up to 2.5.4

Fixed in:

2.5.4