Classified Listing
CVE-2023-37387
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme Classified Listing plugin <= 2.4.5 versions.
AnalysisAI
Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme Classified Listing plugin <= 2.4.5 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Cross-Site Request Forgery (CSRF) (CWE-352), which allows attackers to trick authenticated users into performing unintended actions. Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme Classified Listing plugin <= 2.4.5 versions. Affected products include: Radiustheme Classified Listing.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement anti-CSRF tokens, validate Origin/Referer headers, use SameSite cookie attribute.
More in Classified Listing
View allBroken object-level authorization in the Classified Listing WordPress plugin (versions 5.3.0 through pre-6.1.1) allows a
The Classified Listing Pro WordPress plugin before 2.0.20 does not escape a generated URL before outputting it back in a
The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classifie
The Classified Listing - Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Cross-Site Req
Insecure Direct Object Reference (IDOR) in the Classified Listing WordPress plugin before 5.3.9 exposes payment receipt
Cross-site scripting in the Classified Listing WordPress plugin (by RadiusTheme) versions 5.4.2 and earlier lets a remot
Unauthenticated reflected/stored Cross-Site Scripting in the Classified Listing WordPress plugin versions 5.3.8 and earl
Unauthorized revenue data disclosure in the Classified Listing WordPress plugin (before 5.4.4) allows any authenticated
The Classified Listing WordPress plugin before version 5.4.4 exposes private, draft, and pending post content to authent
The Classified Listing - Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized a
Path traversal in the Classified Listing WordPress plugin (versions through 5.3.8) enables authenticated low-privileged
Broken access control in the Classified Listing WordPress plugin (versions <= 5.4.2) allows subscriber-level authenticat
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today