These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-level account to modify, corrupt or delete media-library attachments owned by other users, including administrators.
The Classified Listing WordPress plugin before 5.4.4 has a vulnerability allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site, including drafts, pending, and private posts owned by other users. This issue arises from the plugin's failure to perform a capability or ownership check on an AJAX action that returns a post's content. As a [truncated]