CVE-2026-94665 in Classified Listing Plugin
Summary
by MITRE • 10/09/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid Classified Listing classified-listing allows Stored XSS.This issue affects Classified Listing: from n/a through 6.1.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The identified security flaw represents a classic instance of Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or XSS. Specifically, this vulnerability manifests as a Stored XSS within the Mamunur Rashid Classified Listing plugin for WordPress, affecting versions ranging from n/a through 6.1.2. Unlike reflected XSS attacks where malicious scripts are executed immediately via a crafted link, stored vulnerabilities persist on the target server. In this context, an attacker can inject malicious JavaScript code into data fields that are subsequently saved to the application's database. When other users or administrators view the affected pages of the classified listing site, the browser retrieves and executes this embedded script in their session context. This persistence mechanism significantly amplifies the risk profile because the payload does not require social engineering tricks like phishing links to trigger; it is automatically served to every visitor who accesses the compromised content.
From a technical perspective, the root cause lies in insufficient input validation and output encoding mechanisms within the plugin's codebase. When user-supplied data such as classified ad titles, descriptions, or contact information is processed by the application, the system fails to properly sanitize special characters that have meaning in HTML contexts, such as angle brackets, quotation marks, and ampersands. Consequently, these inputs are rendered directly into the DOM without being escaped. This allows an attacker to break out of the intended data context and inject executable script tags or event handlers like onerror or onload attributes. The vulnerability is particularly dangerous because it targets both regular users who browse listings and potentially privileged administrators if they view maliciously crafted ads, thereby escalating the potential impact from a simple session hijacking scenario to full account compromise.
The operational impact of this Stored XSS vulnerability extends beyond mere annoyance or defacement. Attackers can leverage this flaw to steal sensitive information such as administrative cookies, session tokens, and authentication credentials through techniques like cookie theft using document.cookie access. Once an attacker obtains these tokens, they can perform session hijacking to impersonate legitimate users without needing passwords. Furthermore, the vulnerability enables phishing attacks where attackers inject fake login forms or deceptive content into the classified listings page, tricking visitors into revealing their own sensitive data. In more advanced scenarios, the injected scripts can be used to execute arbitrary commands on behalf of the victim if combined with other browser-side exploits or to redirect users to malicious websites hosting malware downloads. This undermines the integrity and trustworthiness of the entire web application ecosystem hosted by the affected WordPress site.
In terms of industry standard classifications, this vulnerability aligns directly with CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The specific variant is categorized under Stored XSS, which corresponds to ATT&CK technique T1059.007 (JavaScript) and often facilitates subsequent tactics such as Credential Access via Browser Session Hijacking or Collection via Screen Capture if combined with other vectors. Security professionals should treat this not merely as a code defect but as a critical pathway for unauthorized access and data exfiltration within the WordPress environment.
To mitigate this vulnerability, immediate action is required to update the Mamunur Rashid Classified Listing plugin to version 6.1.3 or later, where the developer has presumably implemented proper input sanitization and output encoding practices such as using htmlspecialchars with appropriate flags in PHP. For organizations unable to patch immediately due to compatibility concerns, implementing a Web Application Firewall (WAF) can provide an additional layer of defense by filtering out malicious payloads before they reach the application logic or are rendered in the browser. Additionally, enforcing Content Security Policy headers can help mitigate the impact of any successfully injected scripts by restricting the sources from which executable content can be loaded. Regular security audits and code reviews focusing on data handling routines are essential to prevent similar flaws in future development cycles.