Does Directory Listings WordPress plugin – uListing have any unpatched vulnerabilities?

Yes — Directory Listings WordPress plugin – uListing currently has 6 published unpatched vulnerabilities. We recommend switching to an alternative or applying any available workarounds.

Is Directory Listings WordPress plugin – uListing compatible with WordPress 6.7.5?

According to WordPress.org data, Directory Listings WordPress plugin – uListing 2.2.0 has been tested up to WordPress 6.7.5. Check the plugin's changelog for the latest compatibility information.

What is Directory Listings WordPress plugin – uListing's security score?

Directory Listings WordPress plugin – uListing has a WP-Safety security score of 2/100. This score is computed from CVE history, patch response time, developer trust signals, and plugin maintenance activity.

Directory Listings WordPress plugin – uListing Security & Risk Analysis

wordpress.org/plugins/ulisting

This directory listings WordPress plugin is a fantastic tool for creating a professional business directory listings website on WordPress with no hass …

1K active installs v2.2.0 PHP + WP 4.6+ Updated Apr 15, 2025

classifiedclassified-adslistingsreal-estate

F · Critical Risk

CVEs total26

Unpatched6

Last CVEFeb 26, 2026

Plugin page Download

Safety Verdict

Is Directory Listings WordPress plugin – uListing Safe to Use in 2026?

Critical Risk — Avoid

Score 2/100

Directory Listings WordPress plugin – uListing is critically unsafe with 26 known CVEs, 6 still unpatched. Avoid in production.

26 known CVEs 6 unpatched Last CVE: Feb 26, 2026Updated 1yr ago

Risk Assessment

The ulisting plugin v2.2.0 presents a significant security risk due to its extensive vulnerability history and concerning static analysis findings. While the plugin demonstrates some good practices, such as a relatively high percentage of SQL prepared statements and output escaping, these are overshadowed by critical weaknesses. The presence of 25 known CVEs, with 5 currently unpatched and a history of critical and high severity vulnerabilities, indicates a recurring pattern of insecure coding. This suggests a lack of robust security auditing and remediation processes within the plugin's development lifecycle.

The static analysis reveals several red flags. Notably, one AJAX handler lacks authentication checks, creating a direct entry point for potential attackers. The use of the dangerous `unserialize` function, coupled with 5 unsanitized taint flows, raises concerns about deserialization vulnerabilities, which can be exploited for remote code execution. Furthermore, the plugin's attack surface includes multiple shortcodes and a cron event, alongside the unprotected AJAX handler, increasing the potential vectors for exploitation.

In conclusion, despite some positive aspects like nonce and capability checks, the ulisting plugin v2.2.0 has a poor security posture. The sheer volume and severity of past vulnerabilities, combined with newly identified weaknesses like the unprotected AJAX handler and deserialization risks, make this plugin a high-risk component. Users should exercise extreme caution, and prompt patching of unaddressed vulnerabilities is critical.

Key Concerns

Multiple unpatched CVEs
Unprotected AJAX handler
Dangerous function: unserialize
Flows with unsanitized paths
Bundled library Select2
Bundled library TinyMCE

Vulnerabilities

26 published

Directory Listings WordPress plugin – uListing Security Vulnerabilities

CVEs by Year

17 CVEs in 2021

2021

1 CVE in 2024

2024

7 CVEs in 2025 · unpatched

2025

1 CVE in 2026 · unpatched

2026

Patched Has unpatched

Severity Breakdown

Critical

High

Medium

26 total CVEs

CVE-2026-28078medium · 4.9Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Directory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Editor+) Arbitrary File Download

Feb 26, 2026Unpatched

CVE-2026-28138medium · 6.6Deserialization of Untrusted Data

uListing <= 2.2.0 - Authenticated (Administrator+) PHP Object Injection

Apr 22, 2025Unpatched

CVE-2025-32662high · 8.8Deserialization of Untrusted Data

uListing <= 2.2.0 - Authenticated (Subscriber+) PHP Object Injection

Apr 15, 2025Unpatched

CVE-2025-32122medium · 4.9Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

uListing <= 2.1.9 - Authenticated (Administrator+) SQL Injection

Apr 4, 2025Unpatched

CVE-2025-1653high · 8.8Incorrect Privilege Assignment

Directory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation

Mar 14, 2025Unpatched

CVE-2025-1657high · 8.8Missing Authorization

Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injection

Mar 14, 2025Unpatched

CVE-2025-25150high · 7.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

uListing <= 2.1.6 - Unauthenticated SQL Injection

Feb 3, 2025 Patched in 2.1.7 (10d)

CVE-2025-25151medium · 6.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

uListing <= 2.1.6 - Authenticated (Contributor+) SQL Injection

Feb 3, 2025 Patched in 2.1.7 (10d)

CVE-2024-47344medium · 5.3Exposure of Sensitive Information to an Unauthorized Actor

uListing <= 2.1.5 - Unauthenticated Information Exposure

Sep 27, 2024 Patched in 2.1.6 (7d)

CVE-2021-4340critical · 9.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

uListing <= 1.6.6 - Unauthenticated SQL Injection

Oct 28, 2021 Patched in 1.7 (817d)

WF-284b9b04-aa8f-41ff-b944-3488c5da8e20-ulistinghigh · 8.8Cross-Site Request Forgery (CSRF)

Listing, Classified Ads & Business Directory – uListing <= 2.0.8 - Cross-Site Request Forgery

Sep 6, 2021 Patched in 2.0.9 (869d)

CVE-2021-36879critical · 9.8Improper Privilege Management

Listing, Classified Ads & Business Directory – uListing <= 2.0.5 - Privilege Escalation

Jul 27, 2021 Patched in 2.0.6 (910d)

CVE-2021-36878medium · 4.3Cross-Site Request Forgery (CSRF)

uListing <= 2.0.5 - Cross-Site Request Forgery leading to Settings Change

Jul 27, 2021 Patched in 2.0.6 (910d)

CVE-2021-36877medium · 6.5Cross-Site Request Forgery (CSRF)

Listing, Classified Ads & Business Directory – uListing <= 2.0.5 - Cross-Site Request Forgery

Jul 27, 2021 Patched in 2.0.6 (910d)

CVE-2021-36876medium · 5.4Cross-Site Request Forgery (CSRF)

Listing, Classified Ads & Business Directory – uListing <= 2.0.5 - Cross-Site Request Forgery

Jul 27, 2021 Patched in 2.0.6 (910d)

CVE-2021-36875medium · 6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Listing, Classified Ads & Business Directory – uListing <= 2.0.5 - Reflected Cross-Site Scripting

Jul 27, 2021 Patched in 2.0.6 (910d)

CVE-2021-36874high · 7.1Authorization Bypass Through User-Controlled Key

uListing plugin <= 2.0.5 - Authenticated Insecure Direct Object References (IDOR)

Jul 27, 2021 Patched in 2.0.6 (910d)

CVE-2021-36880critical · 9.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Listing, Classified Ads & Business Directory – uListing <= 2.0.3 - Unauthenticated SQL Injection

Jul 26, 2021 Patched in 2.0.4 (911d)

CVE-2021-4339high · 7.5Missing Authorization

uListing <= 1.6.6 - Unauthenticated Information Disclosure