CVE-2026-96647
Received Received - Intake

Stored XSS in Listdom WordPress Plugin

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: Wordfence

Description
The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsd[remark]' Parameter in all versions up to, and including, 6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users because the listing-creation branch of the AJAX handler omits a capability check, and the required nonce is publicly emitted on any page containing the [listdom-dashboard] shortcode.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-96647
EUVD
EUVD-2026-91255

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
listdom listdom to 6.1.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the Listdom WordPress plugin. It allows authenticated attackers with contributor-level access or higher to inject malicious scripts into web pages via the 'lsd[remark]' parameter. The plugin fails to properly sanitize input and escape output, enabling script execution when users view the affected pages.

Detection Guidance

To detect this vulnerability, inspect WordPress sites using the Listdom plugin for versions up to 6.1.1. Check for suspicious scripts in user-generated content, particularly via the 'lsd[remark]' parameter. Review server logs for unusual AJAX requests to 'admin-ajax.php' with the 'listdom-dashboard' shortcode.

Impact Analysis

An attacker could steal user sessions, redirect users to malicious sites, or perform actions on their behalf. Since Subscriber-level users can exploit it, the risk is higher as more users have this access level. The impact includes potential data theft, account compromise, and website defacement.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data protection) and HIPAA (health data security) by enabling unauthorized access to user data. If exploited, it may result in data breaches, triggering legal penalties, fines, or reputational damage for organizations handling sensitive information.

Mitigation Strategies

Immediately update the Listdom plugin to the latest version beyond 6.1.1. Remove or restrict contributor-level access to untrusted users. Implement input sanitization for the 'lsd[remark]' parameter and ensure output escaping in all dynamic content. Monitor for unauthorized script injections in pages.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96647. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart