Classified Listing – Classified ads & Business Directory Plugin <= 4.0.4 - Unauthenticated Settings Exposure

Wordfence Intelligence   >   Vulnerability Database   >   Classified Listing – Classified ads & Business Directory Plugin <= 4.0.4 - Unauthenticated Settings Exposure
5.3
Exposure of Sensitive Information to an Unauthorized Actor
CVE CVE-2025-1063
CVSS 5.3 (Medium)
Publicly Published February 24, 2025
Last Updated February 25, 2025
Researcher wesley (wcraft)

Description

The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.4 via the rtcl_taxonomy_settings_export function. This makes it possible for unauthenticated attackers to extract sensitive data including API keys and tokens.

References

Share

Vulnerability Details for Classified Listing – AI-Powered Classified ads & Business Directory

Classified Listing – AI-Powered Classified ads & Business Directory

Software Type Plugin
Software Slug classified-listing (view on wordpress.org)
Patched? Yes
Remediation Update to version 4.0.5, or a newer patched version
Affected Version
  • <= 4.0.4
Patched Version
  • 4.0.5

Recent vulnerabilities in Classified Listing – AI-Powered Classified ads & Business Directory

Classified Listing <= 5.4.3 - Missing Authorization
4.3
CVE-2026-16276
Jul 23, 2026
Researcher: Huseyin Mertoglu
Classified Listing <= 5.4.3 - Missing Authorization
4.3
CVE-2026-16274
Jul 23, 2026
Researcher: Huseyin Mertoglu
Classified Listing – AI-Powered Classified ads & Business Directory <= 5.4.2 - Missing Authorization
4.3
CVE-2026-57355
Jul 1, 2026
Researcher: Septio Noerdiansyah
Classified Listing <= 5.3.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Receipt Disclosure
4.3
CVE-2026-14183
Jun 30, 2026
Researcher: PO-WEI TING (Dinlon5566) , Open Information Security Inc.
Classified Listing – AI-Powered Classified ads & Business Directory <= 5.4.2 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-57344
Jun 29, 2026
Researcher: daroo
Classified Listing <= 5.4.2 - Missing Authorization to Authenticated (Subscriber+) Feature Modification via Multiple AJAX Handlers ('listingId'/'id' Parameters)
4.3
CVE-2026-10779
Jun 18, 2026
Researcher: Ben Tamam (Ben Tamam)
Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.3.8 - Authenticated (Subscriber+) Arbitrary File Download
4.3
CVE-2026-42679
May 17, 2026
Researcher: thevietronin
Classified Listing <= 5.3.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via add_order_note and send_email_to_user_by_moderator AJAX Actions
4.3
CVE-2026-7563
May 14, 2026
Researcher: momopon1415
Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.3.8 - Missing Authorization
5.3
CVE-2026-42640
Apr 29, 2026
Researcher: Cruzer
Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.3.8 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-42658
Apr 29, 2026
Researcher: endy
# Title CVE ID CVSS Researchers Date
1 Classified Listing <= 5.4.3 - Missing Authorization CVE-2026-16276 4.3 Huseyin Mertoglu July 23, 2026
2 Classified Listing <= 5.4.3 - Missing Authorization CVE-2026-16274 4.3 Huseyin Mertoglu July 23, 2026
3 Classified Listing – AI-Powered Classified ads & Business Directory <= 5.4.2 - Missing Authorization CVE-2026-57355 4.3 Septio Noerdiansyah July 1, 2026
4 Classified Listing <= 5.3.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Receipt Disclosure CVE-2026-14183 4.3 PO-WEI TING (Dinlon5566) , Open Information Security Inc. June 30, 2026
5 Classified Listing – AI-Powered Classified ads & Business Directory <= 5.4.2 - Unauthenticated Stored Cross-Site Scripting CVE-2026-57344 7.2 daroo June 29, 2026
6 Classified Listing <= 5.4.2 - Missing Authorization to Authenticated (Subscriber+) Feature Modification via Multiple AJAX Handlers ('listingId'/'id' Parameters) CVE-2026-10779 4.3 Ben Tamam (Ben Tamam) June 18, 2026
7 Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.3.8 - Authenticated (Subscriber+) Arbitrary File Download CVE-2026-42679 4.3 thevietronin May 17, 2026
8 Classified Listing <= 5.3.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via add_order_note and send_email_to_user_by_moderator AJAX Actions CVE-2026-7563 4.3 momopon1415 May 14, 2026
9 Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.3.8 - Missing Authorization CVE-2026-42640 5.3 Cruzer April 29, 2026
10 Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.3.8 - Unauthenticated Stored Cross-Site Scripting CVE-2026-42658 7.2 endy April 29, 2026
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation