Advanced Classifieds & Directory Pro vulnerabilities

The Advanced Classifieds & Directory Pro plugin for WordPress up to version 3.4.4 is vulnerable to Stored Cross-Site Scripting via the 'phone' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with custom-level access can inject arbitrary web scripts that execute when a user accesses an injected page. The vulnerability is only exploitable on sites where the 'Force Bootstrap' setting is enabled and the 'ACADP Listing Address' widget is placed on a sidebar displayed on single listing pages; both conditions are non-default.

The Advanced Classifieds & Directory Pro plugin before version 3.4.3 (<= 3.4.2) is vulnerable to unauthenticated sensitive information exposure via the AJAX action `acadp_public_custom_fields_listings`.

CSRF vulnerability in Advanced Classifieds & Directory Pro up to version 3.2.9. Allows an attacker to perform unauthorized actions in the context of a logged-in user.