CVE-2026-104722
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
The Listdom plugin for WordPress up to version 6.1.2 is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSD_Menus_IX_CSV::import function. Authenticated attackers with administrator-level access can delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Risk Assessment
An attacker can delete critical files, potentially leading to complete site compromise, downtime, or remote code execution.
Recommendation
Immediately update the plugin to the latest version. Also, implement proper file path validation and restrict access to the CSV import function to trusted administrators only.
Other vulnerabilities in Listdom
See all- CVE-2026-61969Critical
Unauthenticated SQL Injection vulnerability in Listdom versions up to 5.6.0. An attacker can execute arbitrary SQL queries without authentication.
- CVE-2026-96647Medium
The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lsd[remark]' parameter in all versions up to, and including, 6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users because the listing-creation branch of the AJAX handler omits a capability check, and the required nonce is publicly emitted on any page containing the [listdom-dashboard] shortcode.
- CVE-2026-19796High
The Listdom plugin for WordPress up to version 5.8.1 is vulnerable to stored cross-site scripting via the 'lsd[displ][style]' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts on pages that will execute whenever a user accesses an injected page. Exploitation requires the Listdom Pro add-on to be active and the 'Display Options Per Listing' setting enabled.
- CVE-2026-49063High
Listdom versions up to 5.5.0 contain a vulnerability that allows unauthenticated privilege escalation.
- CVE-2025-67560Medium
The Listdom plugin (Webilia Inc.) up to version 5.0.1 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSD_Menus_IX_CSV::import function in all versions up to, and including, 6.1.2 This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS