cridio Vulnerabilities and Affected Products

Products

listingpro8 vulnerabilities

cridio vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2025-64377HIGH	WordPress ListingPro theme < 2.9.10 - Local File Inclusion vulnerability Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CridioStudio ListingPro listingpro allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through < 2.9.10. CWE-98Dec 18, 2025	CVSS8.1v3.1	EPSS0.358%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-39622CRITICAL	WordPress ListingPro theme <= 2.9.4 - Unauthenticated SQL Injection vulnerability Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro listingpro allows SQL Injection.This issue affects ListingPro: from n/a through <= 2.9.4. CWE-89Aug 29, 2024	CVSS9.3v3.1	EPSS0.462%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-38795CRITICAL	WordPress ListingPro plugin <= 2.9.4 - Unauthenticated SQL Injection vulnerability Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro listingpro-plugin allows SQL Injection.This issue affects ListingPro: from n/a through <= 2.9.4. CWE-89Aug 29, 2024	CVSS9.3v3.1	EPSS0.462%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-39619CRITICAL	WordPress ListingPro plugin <= 2.9.4 - Unauthenticated Local File Inclusion vulnerability Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro-plugin allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through <= 2.9.4. CWE-22Aug 1, 2024	CVSS9.0v3.1	EPSS0.553%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-39621HIGH	WordPress ListingPro plugin <= 2.9.4 - Local File Inclusion vulnerability Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro-plugin allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through <= 2.9.4. CWE-22Aug 1, 2024	CVSS8.0v3.1	EPSS0.521%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-39624HIGH	WordPress ListingPro theme <= 2.9.4 - Local File Inclusion vulnerability Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through <= 2.9.4. CWE-22Aug 1, 2024	CVSS8.5v3.1	EPSS0.525%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2020-36723MEDIUM	ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Sensitive Information Disclosure The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the ~/listingpro-plugin/functions.php file. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, full names, email addresses, phone numbers, physical addresses and user post counts. CWE-200Jun 7, 20231 related artifact	CVSS5.3v3.1	EPSS1.61%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2020-36719CRITICAL	ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Arbitrary Plugin Installation, Activation and Deactivation The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lp_cc_addons_actions function. This makes it possible for unauthenticated attackers to arbitrarily install, activate and deactivate any plugin. CWE-862Jun 7, 20231 related artifact	CVSS9.8v3.1	EPSS4.3%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX