Ultimate Classified Listings – Classifieds, Directory & Marketplace
Ultimate Classified Listings – Classifieds, Directory & Marketplace has 9 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; 8 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 3 high. 2024 was the busiest year with 5 disclosures.
The most common weakness is Cross-Site Scripting, behind 5 of the records (56%). Other recurring categories include PHP Remote File Inclusion, Cross-Site Request Forgery (CSRF).
8 of the records (89%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.
9 independent researchers contributed these findings, one record each. Ultimate Classified Listings – Classifieds, Directory & Marketplace is installed on roughly 40 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2025-0763Ultimate Classified Listings <= 1.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
Read the full analysisVulnerability Records

Ultimate Classified Listings – Classifieds, Directory & Marketplace
Author
WebCodingPlace
Ultimate Classified Listings is a responsive classifieds and directory plugin for WordPress. It ships nice, clean templates and built-in features like unlimited custom fields, gallery sliders + grids, advanced AJAX search and Google Maps or OpenStreetMap support out of the box. It’s also a full listing management system: register sellers, approve submissions, manage seller profiles, and run your own classifieds, jobs, real-estate, services or community marketplace. Why Ultimate Classified Listings Free where the leaders paywall — maps, AJAX search, frontend submission and custom fields are all free. Stable and secure — A comprehensive security hardening pass: CSRF nonces on every AJAX endpoint, plaintext passwords no longer stored in options, email header injection closed, and rate limiting on auth flows. Theme-friendly — full template override system, works with any WordPress theme. Multilingual ready — WPML and Polylang aware. Developer friendly — 40+ hooks and filters, REST API support on the listing CPT. Core Features Frontend listing submission with custom field sections Unlimited custom fields and field sections (drag-and-drop builder) Categories and tags with custom icons / images Gallery sliders and image grids AJAX-powered search with filters, price range and sort Map search — results plotted on a clustered map with a “Near me” / radius filter One-click demo importer — seed realistic sample listings from the setup wizard Google Maps or OpenStreetMap (Leaflet) with location markers Seller dashboard: add / edit / delete listings, profile management Two seller-registration modes: auto-approve or manual approval Two submission modes: publish immediately or pending review Listing comparison Contact-seller form with reCAPTCHA + email-injection protection Compare and share listings Full theme template overrides under /your-theme/ucl/... Quick Links Live Demo Documentation AJAX Search
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C