Threat database

The Advanced Classifieds & Directory Pro WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'phone' parameter in versions up to and including 3.4.4. This vulnerability requires that the 'Force Bootstrap' setting is enabled and the 'ACADP Listing Address' widget is placed on a sidebar on single listing pages, both of which are non-default configurations. Authenticated users with custom-level access or higher can inject malicious scripts that execute when other users view the affected pages.

Cross-Site Request Forgery (CSRF) vulnerability in pluginsware Advanced Classifieds & Directory Pro advanced-classifieds-and-directory-pro allows Cross Site Request Forgery.This issue affects Advanced Classifieds & Directory Pro: from n/a through <= 3.2.9.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PluginsWare Advanced Classifieds & Directory Pro allows Path Traversal.This issue affects Advanced Classifieds & Directory Pro: from n/a through 3.1.3.

The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the ajax_callback_delete_attachment function in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with subscriber access or higher, to delete arbitrary media uploads.