CVE-2026-19796 in The Listdom Plugin
Summary
by MITRE • 09/01/2026
The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter in all versions up to, and including, 5.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Listdom Pro add-on to be active and the 'Display Options Per Listing' displ setting to be enabled, both of which are non-default configurations.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified within the Listdom plugin for WordPress represents a significant security risk due to its potential for Stored Cross-Site Scripting attacks. This flaw exists in all versions up through 5.8.1 and is specifically triggered by insufficient input sanitization and output escaping mechanisms applied to the lsd[displ][style] parameter. The nature of this vulnerability allows unauthenticated attackers to inject arbitrary web scripts into database-stored content, which are then executed whenever a victim user accesses pages containing the injected payload. This specific attack vector relies on the attacker being able to submit data that is subsequently rendered in the browser without proper validation or encoding, leading to the execution of malicious client-side code within the context of the vulnerable website.
The operational impact of this vulnerability extends beyond simple script injection, as it can facilitate a range of malicious activities including session hijacking, credential theft, defacement, and redirection to phishing sites. Because the payload is stored on the server side rather than being passed via URL parameters or temporary cookies, the attack persists until the compromised content is manually removed from the database. This persistence increases the likelihood of successful exploitation as multiple users may encounter the malicious script over an extended period. The impact is particularly severe in business directory and classifieds environments where user trust and data integrity are paramount for maintaining reputation and operational continuity.
Exploitation of this vulnerability requires specific non-default configurations to be active on the target WordPress site. Specifically, the Listdom Pro add-on must be installed and activated, along with the Display Options Per Listing feature enabled via the displ setting. While these requirements limit the immediate attack surface compared to vulnerabilities present in default installations, they do not eliminate the risk for sites utilizing premium features or advanced customization options. Attackers targeting such configurations can still achieve arbitrary code execution by crafting requests that exploit the lack of proper sanitization on the style parameter within the listing display settings.
From a technical classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves stored XSS where user-controllable input is not properly validated before being saved to persistent storage and subsequently rendered in HTML without appropriate encoding. In terms of the MITRE ATT&CK framework, this behavior corresponds to techniques involving client-side injection such as T1059 Command and Scripting Interpreter or potentially T1189 Drive-by Compromise if used for initial access via phishing links leading to compromised pages. The failure to sanitize output before rendering is a classic example of insufficient validation at the presentation layer rather than solely at the input entry point.
Mitigation strategies should prioritize immediate remediation by upgrading the Listdom plugin to version 5.8.2 or later where these sanitization and escaping issues have been addressed. For organizations unable to upgrade immediately, implementing Web Application Firewall rules that detect and block requests containing suspicious script tags within the lsd[displ][style] parameter can provide a temporary layer of defense. Additionally, enforcing strict Content Security Policy headers can help mitigate the impact of any successfully injected scripts by restricting the sources from which executable content can be loaded. Regular security audits focusing on input validation and output encoding practices are essential to prevent similar vulnerabilities in custom WordPress plugins or themes that handle user-generated content for public display.