Missing Authorization
12 records42.9%First: 2021. Latest: 2026.
Plugin security history
Directory Listings WordPress plugin – uListing Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 28 vulnerability records associated with Directory Listings WordPress plugin – uListing, published between 2021 and 2026.
Dataset last synchronized: 2026-08-03 00:31:25 UTC
At a glance
Security Snapshot
28Total records
9Critical
7High
11Medium
0Low
1Informational
20Patched records
8Currently marked unpatched
2021-01-28First disclosure
2026-07-22Latest disclosure
27 of 28CVE coverage
Use this history
Check and watch Directory Listings WordPress plugin – uListing.
A history record does not establish whether the version installed on your website is affected. Enter the exact version in the checker, or add this software to a private Critical/High alert watchlist.
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2021 | 17 | |
| 2024 | 1 | |
| 2025 | 7 | |
| 2026 | 3 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| Critical | 9 | 32.1% |
| High | 7 | 25% |
| Medium | 11 | 39.3% |
| Informational | 1 | 3.6% |
Vulnerability-Type Breakdown
SQL Injection
5 records17.9%First: 2021. Latest: 2025.
CSRF
4 records14.3%First: 2021. Latest: 2021.
Privilege Escalation
2 records7.1%First: 2021. Latest: 2025.
Other
2 records7.1%First: 2025. Latest: 2025.
Cross-Site Scripting
1 record3.6%First: 2021. Latest: 2021.
Information Disclosure
1 record3.6%First: 2024. Latest: 2024.
Path Traversal
1 record3.6%First: 2026. Latest: 2026.
Patch Status
- Patched
- 20
- Currently marked unpatched
- 8
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
2.1.72.1.62.0.92.0.62.0.41.7
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
*-2.2.0 | Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization | July 22, 2026 | Not supplied | Medium |
*-2.2.0 | Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization | July 22, 2026 | Not supplied | Medium |
*-2.2.0 | Directory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Editor+) Arbitrary File Download | February 26, 2026 | Not supplied | Medium |
*-2.2.0 | uListing <= 2.2.0 - Authenticated (Administrator+) PHP Object Injection | April 22, 2025 | Not supplied | Medium |
*-2.2.0 | uListing <= 2.2.0 - Authenticated (Subscriber+) PHP Object Injection | April 15, 2025 | Not supplied | High |
*-2.1.9 | uListing <= 2.1.9 - Authenticated (Administrator+) SQL Injection | April 4, 2025 | Not supplied | Medium |
*-2.2.0 | Directory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation | March 14, 2025 | Not supplied | High |
*-2.2.0 | Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injection | March 14, 2025 | Not supplied | High |
*-2.1.6 | uListing <= 2.1.6 - Authenticated (Contributor+) SQL Injection | February 3, 2025 | 2.1.7 | Medium |
*-2.1.6 | uListing <= 2.1.6 - Unauthenticated SQL Injection | February 3, 2025 | 2.1.7 | High |
*-2.1.5 | uListing <= 2.1.5 - Unauthenticated Information Exposure | September 27, 2024 | 2.1.6 | Medium |
[*, 1.7) | uListing <= 1.6.6 - Unauthenticated SQL Injection | October 28, 2021 | 1.7 | Critical |
*-2.0.8 | Listing, Classified Ads & Business Directory – uListing <= 2.0.8 - Cross-Site Request Forgery | September 6, 2021 | 2.0.9 | High |
*-2.0.5 | Listing, Classified Ads & Business Directory – uListing <= 2.0.5 - Privilege Escalation | July 27, 2021 | 2.0.6 | Critical |
*-2.0.5 | uListing <= 2.0.5 - Cross-Site Request Forgery leading to Settings Change | July 27, 2021 | 2.0.6 | Medium |
*-2.0.5 | Listing, Classified Ads & Business Directory – uListing <= 2.0.5 - Cross-Site Request Forgery | July 27, 2021 | 2.0.6 | Medium |
*-2.0.5 | Listing, Classified Ads & Business Directory – uListing <= 2.0.5 - Cross-Site Request Forgery | July 27, 2021 | 2.0.6 | Medium |
*-2.0.5 | Listing, Classified Ads & Business Directory – uListing <= 2.0.5 - Reflected Cross-Site Scripting | July 27, 2021 | 2.0.6 | Medium |
*-2.0.5 | uListing plugin <= 2.0.5 - Authenticated Insecure Direct Object References (IDOR) | July 27, 2021 | 2.0.6 | High |
*-2.0.3 | Listing, Classified Ads & Business Directory – uListing <= 2.0.3 - Unauthenticated SQL Injection | July 26, 2021 | 2.0.4 | Critical |
[*, 1.7) | uListing <= 1.6.6 - Unauthenticated Options Changes via wp_route | January 28, 2021 | 1.7 | Critical |
[*, 1.7) | uListing <= 1.6.6 - Missing Authorization | January 28, 2021 | 1.7 | Critical |
[*, 1.7) | uListing <= 1.6.6 - Unauthenticated Arbitrary Post/Page Deletion | January 28, 2021 | 1.7 | Critical |
[*, 1.7) | uListing <= 1.6.6 - Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion | January 28, 2021 | 1.7 | Medium |
[*, 1.7) | uListing <= 1.6.6 - Unauthenticated Arbitrary Account Changes | January 28, 2021 | 1.7 | Critical |
Selected source records
Latest Records
MediumCVE-2026-27392
Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization
Published: July 22, 2026
- Affected versions
- *-2.2.0
- Patched versions
- Not supplied
MediumCVE-2026-27391
Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization
Published: July 22, 2026
- Affected versions
- *-2.2.0
- Patched versions
- Not supplied
MediumCVE-2026-28078
Directory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Editor+) Arbitrary File Download
Published: February 26, 2026
- Affected versions
- *-2.2.0
- Patched versions
- Not supplied
MediumCVE-2026-28138
uListing <= 2.2.0 - Authenticated (Administrator+) PHP Object Injection
Published: April 22, 2025
- Affected versions
- *-2.2.0
- Patched versions
- Not supplied
HighCVE-2025-32662
uListing <= 2.2.0 - Authenticated (Subscriber+) PHP Object Injection
Published: April 15, 2025
- Affected versions
- *-2.2.0
- Patched versions
- Not supplied
MediumCVE-2025-32122
uListing <= 2.1.9 - Authenticated (Administrator+) SQL Injection
Published: April 4, 2025
- Affected versions
- *-2.1.9
- Patched versions
- Not supplied
HighCVE-2025-1653
Directory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation
Published: March 14, 2025
- Affected versions
- *-2.2.0
- Patched versions
- Not supplied
HighCVE-2025-1657
Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injection
Published: March 14, 2025
- Affected versions
- *-2.2.0
- Patched versions
- Not supplied
Highest-Severity Records
CriticalCVE-2021-4340
uListing <= 1.6.6 - Unauthenticated SQL Injection
Published: October 28, 2021
- Affected versions
- [*, 1.7)
- Patched versions
- 1.7
CriticalCVE-2021-4341
uListing <= 1.6.6 - Unauthenticated Wordpress Options Changes via AJAX
Published: January 28, 2021
- Affected versions
- [*, 1.7)
- Patched versions
- 1.7
CriticalCVE-2021-4343
uListing <= 1.6.6 - Unauthenticated Arbitrary Account Creation
Published: January 28, 2021
- Affected versions
- [*, 1.7)
- Patched versions
- 1.7
CriticalCVE-2021-4346
uListing <= 1.6.6 - Unauthenticated Arbitrary Account Changes
Published: January 28, 2021
- Affected versions
- [*, 1.7)
- Patched versions
- 1.7
CriticalCVE-2021-36879
Listing, Classified Ads & Business Directory – uListing <= 2.0.5 - Privilege Escalation
Published: July 27, 2021
- Affected versions
- *-2.0.5
- Patched versions
- 2.0.6
CriticalCVE-2021-36880
Listing, Classified Ads & Business Directory – uListing <= 2.0.3 - Unauthenticated SQL Injection
Published: July 26, 2021
- Affected versions
- *-2.0.3
- Patched versions
- 2.0.4
CriticalCVE-2021-4370
uListing <= 1.6.6 - Missing Authorization
Published: January 28, 2021
- Affected versions
- [*, 1.7)
- Patched versions
- 1.7
CriticalCVE-2021-4381
uListing <= 1.6.6 - Unauthenticated Options Changes via wp_route
Published: January 28, 2021
- Affected versions
- [*, 1.7)
- Patched versions
- 1.7
Currently Marked Unpatched Records
MediumCVE-2026-27392
Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization
Published: July 22, 2026
- Affected versions
- *-2.2.0
- Patched versions
- Not supplied
MediumCVE-2026-27391
Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization
Published: July 22, 2026
- Affected versions
- *-2.2.0
- Patched versions
- Not supplied
MediumCVE-2026-28078
Directory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Editor+) Arbitrary File Download
Published: February 26, 2026
- Affected versions
- *-2.2.0
- Patched versions
- Not supplied
MediumCVE-2026-28138
uListing <= 2.2.0 - Authenticated (Administrator+) PHP Object Injection
Published: April 22, 2025
- Affected versions
- *-2.2.0
- Patched versions
- Not supplied
HighCVE-2025-32662
uListing <= 2.2.0 - Authenticated (Subscriber+) PHP Object Injection
Published: April 15, 2025
- Affected versions
- *-2.2.0
- Patched versions
- Not supplied
MediumCVE-2025-32122
uListing <= 2.1.9 - Authenticated (Administrator+) SQL Injection
Published: April 4, 2025
- Affected versions
- *-2.1.9
- Patched versions
- Not supplied
HighCVE-2025-1653
Directory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation
Published: March 14, 2025
- Affected versions
- *-2.2.0
- Patched versions
- Not supplied
HighCVE-2025-1657
Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injection
Published: March 14, 2025
- Affected versions
- *-2.2.0
- Patched versions
- Not supplied
3Zero Interpretation
uListing stands out in this pilot because the synchronized source currently marks a meaningful portion of its history as unpatched. The dataset contains 28 records from January 2021 through July 2026, including nine critical and seven high-severity records. Missing authorization is the dominant category with 12 records (42.9%), followed by five SQL-injection and four CSRF records.
Eight of the 28 records are currently marked unpatched. Recent entries affecting versions through 2.2.0 include missing authorization, arbitrary file download and PHP object injection; the history also contains privilege-escalation and SQL-injection records. This does not establish that every uListing installation is exploitable, but it does make exact version matching and feature exposure more urgent than a routine update-only response.
The patch state reflects the synchronized Wordfence source and may change when the vendor or source record is updated. It should be verified again before making a production decision.
Practical Next Steps
- Identify whether uListing is installed, active and business-critical. Record the exact version and which front-end listing, account, upload and submission features are enabled.
- Check every matching affected range. The synchronized dataset currently marks recent records through 2.2.0 as unpatched. Do not assume older patched values such as 2.1.7 resolve records that were published later.
- Review the vendor’s current release and advisory status. If no confirmed fix covers the matching records, consider disabling and removing the plugin after preserving listing data and planning a replacement.
- Reduce exposure while a decision is pending. Restrict registration and listing submission, remove unnecessary privileged accounts, protect administrative access and monitor file-download and account activity.
- Investigate if exposure coincided with warning signs. Unknown users, altered listings, unexpected file downloads, injected objects or database changes require a manual review. An unpatched source record alone is not proof of compromise.
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.