CVE-2025-63047
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Missing Authorization vulnerability in CridioStudio ListingPro theme allows exploiting incorrectly configured access control security levels. This issue affects ListingPro from n/a through <= 2.9.9.
Risk Assessment
The risk involves unauthorized access to administrative functions or data, potentially leading to site integrity compromise. The missing authorization can be exploited by unauthenticated or low-privileged users.
Recommendation
It is recommended to immediately update the theme to the latest version that includes security fixes. Additionally, review access control configuration and apply the principle of least privilege.
Other vulnerabilities in ListingPro
See all- CVE-2026-65478Medium
The ListingPro plugin versions up to 2.9.10 contain a subscriber broken access control vulnerability. An attacker with subscriber privileges can bypass access control mechanisms.
- CVE-2026-39438Critical
Unauthenticated SQL Injection exists in ListingPro versions <= 2.9.10.
- CVE-2026-42414High
The ListingPro plugin in versions up to and including 2.9.12 contains a Subscriber-level SQL Injection vulnerability. The flaw allows injection of malicious SQL queries into the database.
- CVE-2025-63046Medium
DOM-Based XSS vulnerability in the ListingPro plugin allows injection of malicious script into the page generated by the plugin. An attacker can exploit this to execute script in the victim's browser.
Original NVD description (English source)
Missing Authorization vulnerability in CridioStudio ListingPro listingpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through <= 2.9.9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS