CVE-2025-63049

MediumCVSS 5.3

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

21th percentile - higher than 21% of all known CVEs

Summary

The ListingPro Lead Form plugin by CridioStudio is vulnerable to Missing Authorization, allowing access to functionality not properly constrained by ACLs. This issue affects ListingPro Lead Form from n/a through <= 1.0.7.

Risk Assessment

The risk involves potential unauthorized access to functionality, which could lead to security breaches and data integrity issues.

Recommendation

It is recommended to update the plugin to the latest version and review access control configurations.

Other vulnerabilities in ListingPro Lead Form

CVE-2025-63048Medium
The ListingPro Lead Form plugin (versions up to and including 1.0.7) contains a DOM-Based Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. A malicious script can be executed in the user's browser through DOM manipulation.

Original NVD description (English source)

Missing Authorization vulnerability in CridioStudio ListingPro Lead Form listingpro-lead-form allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ListingPro Lead Form: from n/a through <= 1.0.7.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS