CVE-2026-62033
HighCVSS 7.6Summary
Subscriber Settings Change in the uListing plugin up to version 2.2.0. A user can change subscription settings without proper permissions.
Risk Assessment
Risk of unauthorized changes to subscriptions, potentially leading to data integrity issues or unauthorized access to features.
Recommendation
Update the uListing plugin to the latest version that includes the security fix.
Other vulnerabilities in uListing
See all- CVE-2026-27392Medium
The uListing plugin for WordPress versions 2.2.0 and earlier contains a broken access control vulnerability exploitable by a Contributor-level user.
- CVE-2026-27391Medium
The uListing plugin for WordPress versions 2.2.0 and earlier contains a broken access control vulnerability exploitable by a Subscriber-level user.
- CVE-2026-62031Critical
SQL Injection vulnerability in uListing versions up to and including 2.2.0. An unauthenticated attacker can inject malicious SQL queries, potentially leading to disclosure or modification of database data. The issue affects unauthenticated access.
Original NVD description (English source)
Subscriber Settings Change in uListing <= 2.2.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS