Medium · 4.3 CVE-2021-36877 EUVD-2021-23453GHSA-rvp5-32cx-hm56

WordPress uListing plugin <= 2.0.5 - Modify User Roles via Cross-Site Request Forgery (CSRF) vulnerability

Published Sep 27, 2021 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: StylemixThemes Product: uListing (WordPress plugin) Category: Web / CMS

Description

Cross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions <= 2.0.5) makes it possible for attackers to modify user roles.

Affected products

Vendor	Product	Affected	Fixed
StylemixThemes	uListing (WordPress plugin)	<= 2.0.5 – ≤ 2.0.5	—

References

https://wordpress.org/plugins/ulisting/#developers
https://patchstack.com/database/vulnerability/ulisting/wordpress-ulisting-plugin-2-0-5-modify-user-roles-via-cross-site-request-forgery-csrf-vulnerability