CVE-2025-67560
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The Listdom plugin (Webilia Inc.) up to version 5.0.1 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Risk Assessment
The risk includes unauthorized access to plugin functionality, potentially leading to content modification or privilege escalation.
Recommendation
Update the plugin to the latest version and review access control configuration.
Other vulnerabilities in Listdom
See all- CVE-2026-61969Critical
Unauthenticated SQL Injection vulnerability in Listdom versions up to 5.6.0. An attacker can execute arbitrary SQL queries without authentication.
- CVE-2026-96647Medium
The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lsd[remark]' parameter in all versions up to, and including, 6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users because the listing-creation branch of the AJAX handler omits a capability check, and the required nonce is publicly emitted on any page containing the [listdom-dashboard] shortcode.
- CVE-2026-19796High
The Listdom plugin for WordPress up to version 5.8.1 is vulnerable to stored cross-site scripting via the 'lsd[displ][style]' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts on pages that will execute whenever a user accesses an injected page. Exploitation requires the Listdom Pro add-on to be active and the 'Display Options Per Listing' setting enabled.
- CVE-2026-49063High
Listdom versions up to 5.5.0 contain a vulnerability that allows unauthenticated privilege escalation.
Original NVD description (English source)
Missing Authorization vulnerability in Webilia Inc. Listdom listdom allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Listdom: from n/a through <= 5.0.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS