https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T00:23:20.007817+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-328946 EUVD-2026-328946 2026-10-09T00:23:20.042506+00:00 EUVD-2026-328946 https://cve.radiocsirt.org/vuln/fkie_cve-2026-10779 fkie_cve-2026-10779 2026-10-09T00:23:20.042543+00:00

The Classified Listing – Classified ads & Business Directory plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.4.2. This is due to a missing capability/ownership check on the gallery_image_update_as_feature AJAX handler (action: rtcl_fb_gallery_image_update_as_feature), which accepts a user-supplied listing ID and attachment ID and sets the featured image of a listing while only validating a nonce that is exposed to any logged-in user on the frontend listing-submission form. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the featured image of arbitrary listings they do not own.

 https://cve.radiocsirt.org/vuln/ghsa-h883-4576-v3x4 GHSA-h883-4576-v3x4 2026-10-09T00:23:20.042584+00:00

The Classified Listing – Classified ads & Business Directory plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.4.2. This is due to a missing capability/ownership check on the gallery_image_update_as_feature AJAX handler (action: rtcl_fb_gallery_image_update_as_feature), which accepts a user-supplied listing ID and attachment ID and sets the featured image of a listing while only validating a nonce that is exposed to any logged-in user on the frontend listing-submission form. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the featured image of arbitrary listings they do not own.