CridioStudio vulnerabilities
Published CVEs affecting CridioStudio products: 16 record(s), with severity, exploitation and fixes.
CVE-2026-42414
High · 8.5
CWE-89 Oct 6, 2026
WordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerability
Subscriber SQL Injection in ListingPro <= 2.9.12 versions.
CVE-2026-65478
Medium · 5.4
CWE-862 Jul 23, 2026
WordPress ListingPro plugin <= 2.9.10 - Broken Access Control vulnerability
Subscriber Broken Access Control in ListingPro <= 2.9.10 versions.
CVE-2026-56046
Medium · 6.5
CWE-79 Jun 26, 2026
WordPress ListingPro theme <= 2.9.11 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in ListingPro <= 2.9.11 versions.
CVE-2026-28122
High · 7.1
CWE-79 Mar 5, 2026
WordPress ListingPro plugin <= 2.9.8 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro listingpro-plugin allows Reflected XSS.This issue affects ListingPro: from n/a through <= 2.9.8.
CVE-2025-69051
High · 7.1
CWE-79 Jan 22, 2026
WordPress ListingPro Reviews theme <= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro Reviews listingpro-reviews allows Reflected XSS.This issue affects ListingPro Reviews: from n/a through < 2.9.11.
CVE-2025-64378
High · 7.1
CWE-862 Dec 18, 2025
WordPress ListingPro theme < 2.9.10 - Broken Access Control vulnerability
Missing Authorization vulnerability in CridioStudio ListingPro listingpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through < 2.9.10.
CVE-2025-64377
High · 8.1
CWE-98 Dec 18, 2025
WordPress ListingPro theme < 2.9.10 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CridioStudio ListingPro listingpro allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through < 2.9.10.
CVE-2025-64376
High · 7.1
CWE-79 Dec 18, 2025
WordPress ListingPro theme < 2.9.10 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro listingpro allows Reflected XSS.This issue affects ListingPro: from n/a through < 2.9.10.
CVE-2025-63039
Medium · 6.5
CWE-862 Dec 18, 2025
WordPress ListingPro theme <= 2.9.9 - Broken Access Control vulnerability
Missing Authorization vulnerability in CridioStudio ListingPro listingpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through <= 2.9.9.
CVE-2025-63049
Medium · 5.3
CWE-862 Dec 9, 2025
WordPress ListingPro Lead Form plugin <= 1.0.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in CridioStudio ListingPro Lead Form listingpro-lead-form allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ListingPro Lead Form: from n/a through <= 1.0.7.
CVE-2025-63048
Medium · 6.5
CWE-79 Dec 9, 2025
WordPress ListingPro Lead Form plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro Lead Form listingpro-lead-form allows DOM-Based XSS.This issue affects ListingPro Lead Form: from n/a through <= 1.0.7.
CVE-2025-63047
Medium · 5.3
CWE-862 Dec 9, 2025
WordPress ListingPro theme <= 2.9.9 - Broken Access Control vulnerability
Missing Authorization vulnerability in CridioStudio ListingPro listingpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through <= 2.9.9.
CVE-2025-63046
Medium · 6.5
CWE-79 Dec 9, 2025
WordPress ListingPro plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro listingpro-plugin allows DOM-Based XSS.This issue affects ListingPro: from n/a through <= 2.9.9.
CVE-2025-10706
High · 8.8
CWE-862 Oct 16, 2025
Classified Pro <= 1.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
The Classified Pro theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check in the 'cwp_addons_update_plugin_cb' function in all versions up to, and including, 1.0.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the affected site's server which may make remote code execution possible. Note: The required nonce for the vulnerability is in the CubeWP Framework plugin.
CVE-2025-60103
Medium · 5.4
CWE-862 Sep 26, 2025
WordPress ListingPro plugin <= 2.9.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in CridioStudio ListingPro listingpro-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through <= 2.9.8.
CVE-2025-58667
Medium · 5.4
CWE-862 Sep 22, 2025
WordPress ListingPro Reviews plugin < 2.9.11 - Broken Access Control vulnerability
Missing Authorization vulnerability in CridioStudio ListingPro Reviews listingpro-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro Reviews: from n/a through < 2.9.11.