# Classified Listing – AI-Powered Classified ads & Business Directory

> AI-powered Classified ads & Business Directory plugin for WordPress to build classifieds, listings, real estate & local business directory sites.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 09:33 UTC.

## Facts (WordPress.org)

- Slug: `classified-listing`
- Author: RadiusTheme
- Version: 6.2.1
- Active installs: 8,000+
- Last update: 2026-11-11 (2 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 6.0, PHP 7.4
- Tags: business directory, classifieds, directory, directory plugin, listings
- Page: https://wordpress.org/plugins/classified-listing/

## Checks (against WordPress 7.1.4)

- OK: Updated 2 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Behind ↔ Current, Heavy ↔ Light, Pushy ↔ Fair, Closed ↔ Agent-ready, Leaves a mess ↔ Clean exit, Focused ↔ All-in-one (personality).

## Known vulnerabilities

- 2026-10-19 HIGH: Authenticated (Subscriber+) Arbitrary PHP Code Execution (up to 6.1.5). CVE-2026-111828, https://www.wordfence.com/threat-intel/vulnerabilities/id/9cd8338c-9987-4a7b-bd10-757a2595aaad?source=api-prod
- 2026-10-14 MEDIUM: Missing Authorization (before 6.1.1). CVE-2026-106646, https://www.wordfence.com/threat-intel/vulnerabilities/id/d8c99ca9-74dc-4dca-8fa2-f637e98a32a8?source=api-prod
- 2026-10-09 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting (up to 6.1.2). CVE-2026-94665, https://www.wordfence.com/threat-intel/vulnerabilities/id/0ffc7596-436d-4f29-8921-013d6c20b7ae?source=api-prod
- 2026-09-30 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 6.1.3). CVE-2026-96351, https://www.wordfence.com/threat-intel/vulnerabilities/id/d67a5bf3-37fc-4739-8e08-ef60e547d378?source=api-prod
- 2026-09-04 MEDIUM: Authenticated (Subscriber+) Insecure Direct Object Reference (up to 6.1.0). CVE-2026-16281, https://www.wordfence.com/threat-intel/vulnerabilities/id/621412c6-83fc-4770-ac8d-d76cb9b7f6e4?source=api-prod
- 2026-09-02 MEDIUM: Missing Authorization (up to 6.1.3). CVE-2026-84217, https://www.wordfence.com/threat-intel/vulnerabilities/id/7ac4388b-0d23-4d42-910f-8391730fd312?source=api-prod
- 2026-08-03 MEDIUM: Missing Authorization (up to 5.4.3). CVE-2026-16274, https://www.wordfence.com/threat-intel/vulnerabilities/id/e00672e0-ce3a-45ac-9901-7497eb1cc1a2?source=api-prod
- 2026-08-03 MEDIUM: Missing Authorization (up to 5.4.3). CVE-2026-16276, https://www.wordfence.com/threat-intel/vulnerabilities/id/13648a6d-481d-4eb4-82c8-30476454793e?source=api-prod
- 2026-07-21 MEDIUM: Insecure Direct Object Reference to Authenticated (Subscriber+) Receipt Disclosure (up to 5.3.8). CVE-2026-14183, https://www.wordfence.com/threat-intel/vulnerabilities/id/51560b6e-e926-4c3e-aa43-d604e7239a91?source=api-prod
- 2026-07-02 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 5.4.2). CVE-2026-57344, https://www.wordfence.com/threat-intel/vulnerabilities/id/38ce5790-f6b8-43a0-a1a3-290a86eb49cb?source=api-prod
- 2026-07-02 MEDIUM: Missing Authorization (up to 5.4.2). CVE-2026-57355, https://www.wordfence.com/threat-intel/vulnerabilities/id/f2fb18eb-a5ce-463f-aae2-55dc0bb3e9c7?source=api-prod
- 2026-06-19 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Feature Modification via Multiple AJAX Handlers ('listingId'/'id' Parameters) (up to 5.4.2). CVE-2026-10779, https://www.wordfence.com/threat-intel/vulnerabilities/id/5f7660ba-c3be-44f0-91cb-809d0021759a?source=api-prod
- 2026-06-15 MEDIUM: Missing Authorization (up to 5.3.8). CVE-2026-42640, https://www.wordfence.com/threat-intel/vulnerabilities/id/cbb25a81-a92b-4773-9194-9aa355750817?source=api-prod
- 2026-06-15 MEDIUM: Missing Authorization (up to 5.3.9). CVE-2026-42651, https://www.wordfence.com/threat-intel/vulnerabilities/id/70dda3b3-8515-49b2-8e45-21ceb9aeb419?source=api-prod
- 2026-06-15 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 5.3.8). CVE-2026-42658, https://www.wordfence.com/threat-intel/vulnerabilities/id/f0e6b405-0843-4469-ae60-7023dea0786f?source=api-prod
- 2026-06-01 MEDIUM: Authenticated (Subscriber+) Arbitrary File Download (up to 5.3.8). CVE-2026-42679, https://www.wordfence.com/threat-intel/vulnerabilities/id/9a724287-5b9c-45cb-ab83-28d73ddc39ec?source=api-prod
- 2026-05-15 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via add_order_note and send_email_to_user_by_moderator AJAX... (up to 5.3.10). CVE-2026-7563, https://www.wordfence.com/threat-intel/vulnerabilities/id/07cb3d57-d768-49a5-8af0-9dc4384487d5?source=api-prod
- 2026-02-23 MEDIUM: Authenticated (Subscriber+) Sensitive Data Exposure (up to 5.3.4). CVE-2026-23546, https://www.wordfence.com/threat-intel/vulnerabilities/id/abebfbc4-37ed-44d5-a35d-d6ad87346f3a?source=api-prod
- 2025-11-17 MEDIUM: Authenticated (Subscriber+) Arbitrary Shortcode Execution via Listing Description (up to 5.0.3). CVE-2025-7711, https://www.wordfence.com/threat-intel/vulnerabilities/id/d9b10db9-0c7c-4f13-9d98-6d407446cfb8?source=api-prod
- 2025-11-10 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Listing Types Tampering (up to 5.2.0). CVE-2025-12953, https://www.wordfence.com/threat-intel/vulnerabilities/id/811f147e-5829-4f7e-91d8-9dba780950d5?source=api-prod
- 2025-09-03 MEDIUM: Missing Authorization (up to 5.0.6). CVE-2025-58601, https://www.wordfence.com/threat-intel/vulnerabilities/id/60782340-8913-4114-8544-109337795f45?source=api-prod
- 2025-07-30 MEDIUM: Authenticated (Contributor+) Content Injection (up to 5.0.0). CVE-2025-54698, https://www.wordfence.com/threat-intel/vulnerabilities/id/baf2af6b-277e-4613-b066-1f2acda56602?source=api-prod
- 2025-06-19 HIGH: Authenticated (Contributor+) Local File Inclusion (up to 4.2.0). CVE-2025-52715, https://www.wordfence.com/threat-intel/vulnerabilities/id/517531ec-4160-4287-8499-6266e08223dc?source=api-prod
- 2025-02-24 MEDIUM: Unauthenticated Settings Exposure (up to 4.0.4). CVE-2025-1063, https://www.wordfence.com/threat-intel/vulnerabilities/id/e701b771-59f2-4783-b0a1-bea4d6c3d245?source=api-prod
- 2024-11-18 HIGH: Authenticated (Subscriber+) Limited Arbitrary Option Update (up to 3.1.15.1). CVE-2024-11194, https://www.wordfence.com/threat-intel/vulnerabilities/id/13d9a59f-1a1a-4936-a5ab-8a5e0c50303b?source=api-prod
- 2024-11-11 HIGH: Authenticated (Contributor+) Local File Inclusion (up to 3.1.16). CVE-2024-52386, https://www.wordfence.com/threat-intel/vulnerabilities/id/8e926708-3c7f-4d7b-a64b-209f696984f9?source=api-prod
- 2024-10-27 MEDIUM: Reflected Cross-Site Scripting (up to 4.0.1). CVE-2025-24745, https://www.wordfence.com/threat-intel/vulnerabilities/id/41fcf001-84da-4baf-9f43-5911ad33af35?source=api-prod
- 2024-09-12 MEDIUM: Missing Authorization (up to 3.1.7). CVE-2024-7888, https://www.wordfence.com/threat-intel/vulnerabilities/id/494d2e69-0759-419a-a603-e8870c157e49?source=api-prod
- 2024-04-24 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion (up to 3.0.10.3). CVE-2024-3893, https://www.wordfence.com/threat-intel/vulnerabilities/id/e7113b1c-78dc-4648-b14a-52ff6668fd1d?source=api-prod
- 2024-04-04 HIGH: Cross-Site Request Forgery to Account Takeover via rtcl_update_user_account (up to 3.0.4). CVE-2024-1315, https://www.wordfence.com/threat-intel/vulnerabilities/id/5439651e-5557-4b13-813a-4fc0ad876104?source=api-prod
- 2024-04-04 MEDIUM: Missing Authorization (up to 3.0.4). CVE-2024-1352, https://www.wordfence.com/threat-intel/vulnerabilities/id/f5da4cdd-15c7-41a6-be2f-e31bd407ae05?source=api-prod
- 2023-07-05 MEDIUM: Cross-Site Request Forgery via rtcl_ajax_thumbnail_delete (up to 2.4.5). CVE-2023-37387, https://www.wordfence.com/threat-intel/vulnerabilities/id/2352dce7-5302-4892-9ae2-bf814f029af4?source=api-prod
- 2022-08-22 MEDIUM: Reflected Cross-Site Scripting (before 2.2.14). WF-4cfee2e2-3486-4be8-954f-6d7f9b6d54ec-3, https://www.wordfence.com/threat-intel/vulnerabilities/id/4cfee2e2-3486-4be8-954f-6d7f9b6d54ec?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=classified-listing · HTML: https://todaywp.com/plugins/classified-listing