CVE-2026-42414

HighCVSS 8.5

Published: 06/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Summary

The ListingPro plugin in versions up to and including 2.9.12 contains a Subscriber-level SQL Injection vulnerability. The flaw allows injection of malicious SQL queries into the database.

Risk Assessment

A low-privileged attacker can read, modify, or delete database data, potentially leading to information disclosure or site takeover. The risk affects all sites running the vulnerable plugin version.

Recommendation

Update the ListingPro plugin to a version newer than 2.9.12. If no fix is available, consider restricting user registration or disabling the plugin.

Other vulnerabilities in ListingPro

See all

CVE-2026-65478Medium
The ListingPro plugin versions up to 2.9.10 contain a subscriber broken access control vulnerability. An attacker with subscriber privileges can bypass access control mechanisms.
CVE-2026-39438Critical
Unauthenticated SQL Injection exists in ListingPro versions <= 2.9.10.

Original NVD description (English source)

Subscriber SQL Injection in ListingPro <= 2.9.12 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS