CVE-2026-39438
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Unauthenticated SQL Injection exists in ListingPro versions <= 2.9.10.
Risk Assessment
An attacker could exploit this vulnerability to gain access to database data, potentially leading to serious security breaches.
Recommendation
It is recommended to upgrade to the latest version of ListingPro to mitigate this vulnerability.
Other vulnerabilities in ListingPro
See all- CVE-2026-42414High
The ListingPro plugin in versions up to and including 2.9.12 contains a Subscriber-level SQL Injection vulnerability. The flaw allows injection of malicious SQL queries into the database.
- CVE-2026-65478Medium
The ListingPro plugin versions up to 2.9.10 contain a subscriber broken access control vulnerability. An attacker with subscriber privileges can bypass access control mechanisms.
- CVE-2025-63047Medium
Missing Authorization vulnerability in CridioStudio ListingPro theme allows exploiting incorrectly configured access control security levels. This issue affects ListingPro from n/a through <= 2.9.9.
- CVE-2025-63046Medium
DOM-Based XSS vulnerability in the ListingPro plugin allows injection of malicious script into the page generated by the plugin. An attacker can exploit this to execute script in the victim's browser.
- CVE-2025-60103Medium
The ListingPro plugin for WordPress has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 2.9.8.
Original NVD description (English source)
Unauthenticated SQL Injection in ListingPro <= 2.9.10 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS