CVE-2022-3921

PoC —

CVSS 3.1

9.8 critical

EPSS

21%p97

Published

Dec 12, 2022 (Dec 12, 2022)

Modified

Jun 17, 2026

Description

The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE

Vendors: themographics
Products: listingo
Ecosystems: WordPress
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (21.2%)

In the news0 stories

No ingested article mentions this CVE yet.