Stored Cross-Site Scripting in Listdom Plugin for WordPress

CVE-2026-96647

What is CVE-2026-96647?

The Listdom plugin for WordPress is susceptible to Stored Cross-Site Scripting via the 'lsd[remark]' parameter across all versions up to and including 6.1.1. This vulnerability arises from inadequate input sanitization and output escaping, allowing authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts execute when a user accesses the compromised page. Notably, even Subscriber-level users can exploit this due to a lack of capability checks in the listing-creation branch of the AJAX handler. Furthermore, the nonce required for security is publicly exposed on any page featuring the [listdom-dashboard] shortcode, enhancing the risk of exploitation.

References