Skip to content
Sign in
4.4 Medium

CVE-2024-13748 The Ultimate Classified Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title…

Description

The Ultimate Classified Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title parameter in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Affected products and versions

Product Affected versions Fixed in
Ultimate Classified Listings 1.4 earliest → 1.4 No fix stated

Other CVEs of Ultimate Classified Listings

The 6 CVEs of Ultimate Classified Listings →
CVE-2025-9874 The Ultimate Classified Listings plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and… 7.5 High CVE-2025-0763 The Ultimate Classified Listings plugin for WordPress is vulnerable to unauthorized modification of data due to a… 4.3 Medium CVE-2024-13753 The Ultimate Classified Listings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to,… 8.1 High CVE-2024-52487 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webcodingplace… 6.5 Medium
Track this CVE