CVE-2026-19074
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The Advanced Classifieds & Directory Pro plugin before version 3.4.3 (<= 3.4.2) is vulnerable to unauthenticated sensitive information exposure via the AJAX action `acadp_public_custom_fields_listings`.
Risk Assessment
An attacker without authentication can access sensitive data, compromising information confidentiality.
Recommendation
Update the plugin to version 3.4.3 or later.
Other vulnerabilities in Advanced Classifieds & Directory Pro
See all- CVE-2026-93883Medium
The Advanced Classifieds & Directory Pro plugin for WordPress up to version 3.4.4 is vulnerable to Stored Cross-Site Scripting via the 'phone' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with custom-level access can inject arbitrary web scripts that execute when a user accesses an injected page. The vulnerability is only exploitable on sites where the 'Force Bootstrap' setting is enabled and the 'ACADP Listing Address' widget is placed on a sidebar displayed on single listing pages; both conditions are non-default.
- CVE-2025-68580Medium
CSRF vulnerability in Advanced Classifieds & Directory Pro up to version 3.2.9. Allows an attacker to perform unauthorized actions in the context of a logged-in user.
Original NVD description (English source)
The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 (<= 3.4.2) is vulnerable to unauthenticated sensitive information exposure via the AJAX action `acadp_public_custom_fields_listings`.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS