Unauthenticated XSS in Classified Listing

Executive Summary

CVE-2026-57344 is a Cross Site Scripting (XSS) vulnerability found in the WordPress Classified Listing Plugin versions 5.4.2 and below.

This vulnerability allows attackers to inject malicious scripts into the website by exploiting the plugin without authentication.

Successful exploitation requires a privileged user to interact with a malicious link, crafted page, or form submission, which then executes the injected scripts.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects WordPress sites using the Classified Listing Plugin version 5.4.2 or below. Detection involves identifying if your system is running this vulnerable plugin version.

To detect the vulnerability on your system, you can check the installed plugin version by running commands to list WordPress plugins and their versions.

• Use WP-CLI to check the plugin version: wp plugin list --format=json | grep classified-listing
• Manually check the plugin version in the WordPress admin dashboard under Plugins.

For network detection, monitor HTTP requests for suspicious payloads or attempts to inject scripts via URLs or form submissions targeting the Classified Listing plugin endpoints.

No specific detection commands or signatures are provided in the available resources, but applying web application firewall (WAF) rules or Patchstack mitigation rules can help block exploitation attempts until the plugin is updated.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can lead to attackers injecting malicious scripts such as redirects or advertisements into your website.

This can compromise the integrity and security of your website, potentially affecting users by redirecting them to malicious sites or displaying unwanted content.

Because the vulnerability has a CVSS score of 7.1, it represents a moderate risk and could be used in mass campaigns targeting thousands of websites.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the CVE-2026-57344 vulnerability in the WordPress Classified Listing Plugin versions 5.4.2 and below, users should immediately update the plugin to version 5.4.3 where the issue is patched.

Until the update can be applied, users are advised to use mitigation rules provided by Patchstack to block attacks targeting this vulnerability.

Useful 0 Not Useful 0