What’s Vulnerable › Vulnerabilities

CVE-2025-14938: Listeo-Core - Directory Plugin by Purethemes <= 2.0.27 - Unauthenticated Arbitrary Media Upload

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-04 · updated 2026-07-24
• Weakness: CWE-434

Description

The Listeo Core plugin for WordPress is vulnerable to unauthenticated arbitrary media upload in all versions up to, and including, 2.0.27 via the "listeo_core_handle_dropped_media" function. This is due to missing authorization and capability checks on the AJAX endpoint handling file uploads. This makes it possible for unauthenticated attackers to upload arbitrary media to the site's media library, without achieving direct code execution.

Affected products

• purethemes Listeo-Core - Directory Plugin by Purethemes: through 2.0.27

References

• https://docs.purethemes.net/listeo/knowledge-base/changelog-listeo/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4decf597-1819-402f-ab28-2446a3e6215f?source=cve

Get alerted when CVE-2025-14938 or the next vulnerability affects your stack