CVE-2026-96351: WordPress Classified Listing plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerability
Published Sep 30, 2026
·Updated
Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions.
Affected Software
1 affected component
WordPress Classified Listing<=6.1.3
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Classified Listing pluginto a version that resolves this vulnerability.Fixed in 6.1.5
Event History
Sep 30, 2026
CVE Published
via MITRE·12:27 PM
Data Sourced
via MITRE·12:27 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are affected?
WordPress sites using the Classified Listing plugin at version 6.1.3 or earlier are affected according to the available information.
2
Does exploitation require an authenticated WordPress account?
No. The vulnerability is described as unauthenticated, so an attacker does not need a WordPress account or existing plugin privileges.
3
Does an attacker need a victim to take an action?
Yes. The supplied CVSS vector includes UI:R, indicating exploitation requires user interaction.