CVE-2025-64376: WordPress ListingPro theme < 2.9.10 - Cross Site Scripting (XSS) vulnerability
Published Dec 18, 2025
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro listingpro allows Reflected XSS.This issue affects ListingPro: from n/a through < 2.9.10.
Affected Software
1 affected component
CridioStudio ListingPro<2.9.10
Event History
Dec 18, 2025
CVE Published
via MITRE·07:22 AM
Data Sourced
via MITRE·07:22 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-64376?
CVE-2025-64376 is classified as a medium severity reflected Cross-site Scripting (XSS) vulnerability.
2
How do I fix CVE-2025-64376?
To fix CVE-2025-64376, upgrade to ListingPro version 2.9.10 or later.
3
What versions of ListingPro are affected by CVE-2025-64376?
CVE-2025-64376 affects all versions of ListingPro prior to 2.9.10.
4
What type of vulnerability is CVE-2025-64376?
CVE-2025-64376 is a reflected Cross-site Scripting (XSS) vulnerability.
5
Who is the vendor for CVE-2025-64376?
The vendor for CVE-2025-64376 is CridioStudio.