Radiustheme Classified Listing vulnerabilities

17 vulnerabilities

Known vulnerabilities in Radiustheme Classified Listing, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.4MediumCVE-2025-54698radiustheme · classified_listing +1 moreWordPress Classified Listing Plugin plugin <= 5.0.0 - Content Injection VulnerabilityImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in RadiusTheme Classified Listing classified-listing allows Code Injection.This issue affects Classified Listing: from n/a through <= 5.0.0.EPSS0.19%8.8HighCVE-2025-52715radiustheme · classified_listing +1 moreWordPress Classified Listing plugin <= 4.2.0 - Local File Inclusion VulnerabilityImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Classified Listing classified-listing allows PHP Local File Inclusion.This issue affects Classified Listing: from n/a through <= 4.2.0.EPSS0.56%5.3MediumCVE-2025-1063radiustheme · classified_listing +2 moreClassified Listing – Classified ads & Business Directory Plugin <= 4.0.4 - Unauthenticated Settings ExposureThe Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.4 via the rtcl_taxonomy_settings_export function. This makes it possible for unauthenticated attackers to extract sensitive data including API keys and tokens.EPSS0.36%4.3MediumCVE-2025-58601radiustheme · classified_listing +1 moreWordPress Classified Listing Plugin <= 5.0.6 - Broken Access Control VulnerabilityMissing Authorization vulnerability in RadiusTheme Classified Listing classified-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Classified Listing: from n/a through <= 5.0.6.EPSS0.24%7.1HighCVE-2025-24745radiustheme · classified_listing +1 moreWordPress Classified Listing plugin <= 4.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme Classified Listing classified-listing allows Reflected XSS.This issue affects Classified Listing: from n/a through <= 4.0.1.EPSS0.29%6.1MediumCVE-2022-2654radiustheme · classified_listing +13 moreClassima < 2.1.11 - Reflected Cross-Site ScriptingThe Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before 2.0.20, Classified Listing Store & Membership before 1.4.20 and Classima Core before 1.10) do not escape a parameter before outputting it back in attributes, leading to Reflected Cross-Site ScriptingEPSS0.62%6.1MediumCVE-2022-2655radiustheme · classified_listing +2 moreClassified Listing Pro < 2.0.20 - Reflected Cross-Site ScriptingThe Classified Listing Pro WordPress plugin before 2.0.20 does not escape a generated URL before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site ScriptingEPSS0.70%8.8HighCVE-2024-52386radiustheme · classified_listing +1 moreWordPress Classified Listing plugin <= 3.1.16 - Local File Inclusion vulnerabilityImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Classified Listing classified-listing allows PHP Local File Inclusion.This issue affects Classified Listing: from n/a through <= 3.1.16.EPSS0.47%6.5MediumCVE-2024-1352radiustheme · classified_listing +2 moreClassified Listing – Classified ads & Business Directory Plugin <= 3.0.4 - Missing AuthorizationThe Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access & modification of data due to a missing capability check on the rtcl_import_location() rtcl_import_category() functions in all versions up to, and including, 3.0.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to create terms.EPSS0.55%8.8HighCVE-2024-1315radiustheme · classified_listing +2 moreClassified Listing <= 3.0.4 - Cross-Site Request Forgery to Account Takeover via rtcl_update_user_accountThe Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.4. This is due to missing or incorrect nonce validation on the 'rtcl_update_user_account' function. This makes it possible for unauthenticated attackers to change the administrator user's password and email address via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This locks the administrator out of the site and prevents them from resetting their password, while granting the attacker access to their account.EPSS0.45%6.3MediumCVE-2024-7888radiustheme · classified_listing +2 moreClassified Listing – Classified ads & Business Directory Plugin <= 3.1.7 - Missing AuthorizationThe Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions like export_forms(), import_forms(), update_fb_options(), and many more in all versions up to, and including, 3.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify forms and various other settings.EPSS0.29%4.3MediumCVE-2024-3893radiustheme · classified_listing +2 moreClassified Listing – Classified ads & Business Directory Plugin <= 3.0.10.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment DeletionThe Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the rtcl_fb_gallery_image_delete AJAX action in all versions up to, and including, 3.0.10.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary attachements.EPSS0.36%6.5MediumCVE-2026-57355radiustheme · classified_listing +1 moreWordPress Classified Listing plugin <= 5.4.2 - Broken Access Control vulnerabilitySubscriber Broken Access Control in Classified Listing <= 5.4.2 versions.EPSS0.30%7.2HighCVE-2026-57344radiustheme · classified_listing +1 moreWordPress Classified Listing plugin <= 5.4.2 - Cross Site Scripting (XSS) vulnerabilityUnauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versions.EPSS0.25%7.2HighCVE-2026-96351radiustheme · classified_listing +1 moreWordPress Classified Listing plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerabilityUnauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions.EPSS0.18%6.5MediumCVE-2026-23546radiustheme · classified_listing +1 moreWordPress Classified Listing plugin <= 5.3.4 - Sensitive Data Exposure vulnerabilityInsertion of Sensitive Information Into Sent Data vulnerability in RadiusTheme Classified Listing classified-listing allows Retrieve Embedded Sensitive Data.This issue affects Classified Listing: from n/a through <= 5.3.4.EPSS0.38%8.8HighCVE-2023-37387radiustheme · classified_listing +1 moreWordPress Classified Listing Plugin <= 2.4.5 is vulnerable to Cross Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme Classified Listing plugin <= 2.4.5 versions.EPSS0.25%