The vulnerability is an improper neutralization of special elements used in an SQL command that allows attackers to inject arbitrary SQL code through the Stylemix uListing plugin for WordPress, identified as CWE‑89. Based on the description, the flaw permits unauthorized read, write, or delete operations on the site’s database, potentially compromising confidentiality, integrity, and availability of stored data.

WordPress sites that use the Stylemix uListing plugin version 2.1.6 or older are affected. Any installation that has not upgraded beyond 2.1.6 remains vulnerable.

The CVSS score of 8.5 classifies the vulnerability as high severity. The EPSS score of <1% indicates a low current exploitation probability, and the vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is through the plugin’s exposed functionality on a publicly accessible WordPress site, where a user could submit malicious input. Successful exploitation would allow compromise of the site’s database, including potential data theft, corruption, or site disruption.