CVE-2026-94665: WordPress Classified Listing plugin <= 6.1.2 - Cross Site Scripting (XSS) vulnerability

Q: What access and conditions are required for exploitation?

The vector is network-accessible, exploitation complexity is low, and the attacker needs low-level privileges. Exploitation also requires user interaction.

Q: What impact could successful exploitation have?

The vulnerability is a stored XSS issue with low confidentiality, integrity, and availability impact. The reported scope is changed, indicating the impact may extend beyond the vulnerable component's security authority.

Published Oct 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid Classified Listing classified-listing allows Stored XSS.This issue affects Classified Listing: from n/a through 6.1.2.

Affected Software

1 affected component

Mamunur Rashid Classified Listing<=6.1.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Classified Listing to a version that resolves this vulnerability.
Fixed in 6.1.3

Event History

Oct 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What access and conditions are required for exploitation?

The vector is network-accessible, exploitation complexity is low, and the attacker needs low-level privileges. Exploitation also requires user interaction.

What impact could successful exploitation have?