CVE-2021-4346

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The uListing plugin for WordPress is vulnerable to Unauthenticated Arbitrary Account Changes in versions up to, and including, 1.6.6. This is due to missing login checks on the stm_listing_profile_edit AJAX action. This makes it possible for unauthenticated attackers to edit any account on the blog, such as changing the admin account's email address.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
stylemix	Directory Listings WordPress plugin – uListing	< 1.7

References

Timeline

Published: Jun 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-434607.8An Unquoted Service Path vulnerability exists in System Explorer 7.0.0 via via a specially crafted file in the SystemExplorerHelpService ser CVE-2021-434615.4Cross Site Scripting (XSS) vulnerability exists in Rumble Mail Server 0.51.3135 via the servername parameter.CVE-2021-434625.4A Cross Site Scripting (XSS) vulnerability exists in Rumble Mail Server 0.51.3135 via the username parameter.CVE-2021-434637.8An Unquoted Service Path vulnerability exists in Ext2Fsd v0.68 via a specially crafted file in the Ext2Srv Service executable service path.CVE-2021-434648.8A Remiote Code Execution (RCE) vulnerability exiss in Subrion CMS 4.2.1 via modified code in a background field; when the information is mod CVE-2021-434669.8In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code executio CVE-2021-434698.8VINGA WR-N300U 77.102.1.4853 is affected by a command execution vulnerability in the goahead component.CVE-2021-43476.5The function update_shipment_status_email_status_fun in the plugin Advanced Shipment Tracking for WooCommerce in versions up to 3.2.6 is vul CVE-2021-434717.5In Canon LBP223 printers, the System Manager Mode login does not require an account password or PIN. An attacker can remotely shut down the CVE-2021-434749.8An Access Control vulnerability exists in D-Link DIR-823G REVA1 1.02B05 (Lastest) via any parameter in the HNAP1 function CVE-2021-434785.4A vulnerability exists in Hoosk 1.8.0 in /install/index.php, due to a failure to check if config.php already exists in the root directory, w CVE-2021-434799.8A Remote Code Execution (RCE) vulnerability exists in The-Secretary 2.5 via install.php.