CVE-2021-4346

The uListing plugin for WordPress is vulnerable to Unauthenticated Arbitrary Account Changes in versions up to, and including, 1.6.6. This is due to missing login checks on the stm_listing_profile_edit AJAX action. This makes it possible for unauthenticated attackers to edit any account on the blog, such as changing the admin account's email address.

• CWE-862
• CWE-862

• https://blog.nintechnet.com/wordpress-ulisting-plugin-fixed-multiple-critical-vulnerabilities/Exploit
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2456786%40ulisting&new=2456786%40ulisting&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/41800ea9-1ace-42fc-9e7f-d760a126342b?source=cveThird Party Advisory
• https://blog.nintechnet.com/wordpress-ulisting-plugin-fixed-multiple-critical-vulnerabilities/Exploit
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2456786%40ulisting&new=2456786%40ulisting&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/41800ea9-1ace-42fc-9e7f-d760a126342b?source=cveThird Party Advisory

Published

Jun 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43454An Unquoted Service Path vulnerability exists in AnyTXT Sear…7.8
• CVE-2021-43455An Unquoted Service Path vulnerability exists in FreeLAN 2.2…7.8
• CVE-2021-43456An Unquoted Service Path vulnerablility exists in Rumble Mai…7.8
• CVE-2021-43457An Unquoted Service Path vulnerability exists in bVPN 2.5.1 …7.8
• CVE-2021-43458An Unquoted Service Path vulnerability exits in Vembu BDR 4.…7.8
• CVE-2021-43459A Cross Site Scripting (XSS) vulnerability exists in Rumble …5.4
• CVE-2021-43460An Unquoted Service Path vulnerability exists in System Expl…7.8
• CVE-2021-43461Cross Site Scripting (XSS) vulnerability exists in Rumble Ma…5.4
• CVE-2021-43462A Cross Site Scripting (XSS) vulnerability exists in Rumble …5.4
• CVE-2021-43463An Unquoted Service Path vulnerability exists in Ext2Fsd v0.…7.8
• CVE-2021-43464A Remiote Code Execution (RCE) vulnerability exiss in Subrio…8.8
• CVE-2021-43466In the thymeleaf-spring5:3.0.12 component, thymeleaf combine…9.8