CVE-2025-1653: stylemix directory listings wordpress plugin – ulisting Incorrect Privilege Assignment
Vulnerability summary
CVE-2025-1653 is a high (CVSS 8.8) Incorrect Privilege Assignment vulnerability in stylemix directory listings wordpress plugin – ulisting. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 43.4% of scored vulnerabilities.
Timeline
- 15-03-2025PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.0. This is due to the stm_listing_profile_edit AJAX action not having enough restriction on the user meta that can be updated. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.53%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
+0.01 pp
From 0.52% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
3 vendors · 3 products
References
3 links- www.wordfence.com/threat-intel/vulnerabilities/id/4181b26e-89c7-4020-a3d4-29bdc88d7438?source=cveMitigationThird Party Advisory