PT-2025-9815 · WordPress · Listingo

Lucio Sá · Published 2025-03-05 · Updated 2025-03-06 · CVE-2024-13815

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Listingo theme for WordPress versions prior to 3.2.8

Description The issue allows unauthenticated attackers to execute arbitrary shortcodes due to improper validation of a value before running do shortcode. This enables the execution of an action that can lead to arbitrary shortcode execution.

Recommendations For versions prior to 3.2.8, update to version 3.2.8 or later to resolve the issue.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-13815

Affected Products

Listingo

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-13815 · Security Note
• https://twitter.com/WolfgangSesin/status/1897246590420537554 · Twitter Post
• https://themeforest.net/item/listingo-business-listing-wordpress-directory-theme/20617051 · Note
• https://twitter.com/VulmonFeeds/status/1897380075495981057 · Twitter Post
• https://twitter.com/CVEnew/status/1897506934770504102 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e4595a79-c7d0-4e37-b19b-9ae985c9d713?source=cve · Note
• https://twitter.com/WolfgangSesin/status/1897246621672317207 · Twitter Post
• https://t.me/cvedetector/19610 · Telegram Post