CVE-2026-62033
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Subscriber Settings Change in the uListing plugin up to version 2.2.0. A user can change subscription settings without proper permissions.
Risk Assessment
Risk of unauthorized changes to subscriptions, potentially leading to data integrity issues or unauthorized access to features.
Recommendation
Update the uListing plugin to the latest version that includes the security fix.
Other vulnerabilities in uListing
See all- CVE-2026-62031Critical
SQL Injection vulnerability in uListing versions up to and including 2.2.0. An unauthenticated attacker can inject malicious SQL queries, potentially leading to disclosure or modification of database data. The issue affects unauthenticated access.
- CVE-2026-27392Medium
The uListing plugin for WordPress versions 2.2.0 and earlier contains a broken access control vulnerability exploitable by a Contributor-level user.
- CVE-2026-27391Medium
The uListing plugin for WordPress versions 2.2.0 and earlier contains a broken access control vulnerability exploitable by a Subscriber-level user.
Original NVD description (English source)
Subscriber Settings Change in uListing <= 2.2.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS