Critical · 9.3 CVE-2024-38795 EUVD-2024-37631GHSA-2wj5-m5gf-xp7w

WordPress ListingPro plugin <= 2.9.4 - Unauthenticated SQL Injection vulnerability

Published Aug 29, 2024 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: Cridio Studio Product: ListingPro

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro listingpro-plugin allows SQL Injection.This issue affects ListingPro: from n/a through <= 2.9.4.

Affected products

Vendor	Product	Affected	Fixed
CridioStudio	ListingPro	≤ 2.9.4	—

References

https://patchstack.com/database/Wordpress/Plugin/listingpro-plugin/vulnerability/wordpress-listingpro-plugin-2-9-3-unauthenticated-sql-injection-vulnerability?_s_id=cve vdb-entry