CVE-2026-19796: Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.8.1 - Unauthenticated Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter

Q: Are default Listdom installations affected?

Exploitation requires the Listdom Pro add-on to be active and the “Display Options Per Listing” displ setting to be enabled. Both are non-default configurations.

Q: What access does an attacker need to exploit this issue?

No authentication, privileges, or user interaction are required for an attacker to inject the stored script. The injected script executes when someone later accesses the affected page.

Q: Who is exposed if the vulnerable configuration is enabled?

Any user who accesses a page containing the attacker-injected listing content may execute the stored script in their browser. The vulnerability can affect confidentiality and integrity, but no availability impact is stated.

Published Sep 1, 2026

Updated

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter in all versions up to, and including, 5.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Listdom Pro add-on to be active and the 'Display Options Per Listing' displ setting to be enabled, both of which are non-default configurations.

Affected Software

1 affected component

WordPress Listdom: AI-powered Business Directory with Classifieds Ads Listings<=5.8.1

Event History

Sep 1, 2026

CVE Published

via MITRE·04:27 AM

Data Sourced

via MITRE·04:27 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Are default Listdom installations affected?

Exploitation requires the Listdom Pro add-on to be active and the “Display Options Per Listing” displ setting to be enabled. Both are non-default configurations.

What access does an attacker need to exploit this issue?

No authentication, privileges, or user interaction are required for an attacker to inject the stored script. The injected script executes when someone later accesses the affected page.

Who is exposed if the vulnerable configuration is enabled?

Any user who accesses a page containing the attacker-injected listing content may execute the stored script in their browser. The vulnerability can affect confidentiality and integrity, but no availability impact is stated.

CVE-2026-19796: Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.8.1 - Unauthenticated Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter

Affected Software

Event History

Frequently Asked Questions

Are default Listdom installations affected?

What access does an attacker need to exploit this issue?

Who is exposed if the vulnerable configuration is enabled?

Company

Resources

Contact

Frequently Asked Questions

Are default Listdom installations affected?

What access does an attacker need to exploit this issue?

Who is exposed if the vulnerable configuration is enabled?