Stored XSS Vulnerability in Listdom WordPress Plugin

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability, tracked as CVE-2026-19796. The vulnerability stems from insufficient sanitization and escaping of user-supplied input within the 'lsd[displ][style]' parameter.

The issue affects all plugin versions up to and including 5.8.1. Successful exploitation allows an unauthenticated attacker to inject malicious JavaScript into web pages rendered by the plugin. This script executes within the context of the browser session of any user who accesses the compromised page, potentially leading to session hijacking, unauthorized actions, or further client-side exploitation. This vulnerability requires non-default configurations to be present, specifically the activation of the Listdom Pro add-on and the enabling of the 'Display Options Per Listing' setting.

Impact

Successful exploitation results in the execution of arbitrary JavaScript in the victim's browser session. This can lead to account takeover, unauthorized modification of content, or data theft. The vulnerability affects websites utilizing the Listdom plugin with specific premium add-ons enabled, creating a significant risk for directories and classified sites running these components.

Recommendation

1. Update the Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin to the latest version beyond 5.8.1 to incorporate input sanitization patches for CVE-2026-19796.
2. If an immediate update is not possible, disable the Listdom Pro add-on or the 'Display Options Per Listing' functionality to mitigate the exploit path.
3. Deploy web application firewall (WAF) rules to detect and block malicious script injection attempts in POST requests targeting the plugin's configuration parameters.