CVE-2026-49063

Unauthenticated SQL Injection vulnerability in Listdom versions up to 5.6.0. An attacker can execute arbitrary SQL queries without authentication.

The Listdom plugin for WordPress up to version 6.1.2 is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSD_Menus_IX_CSV::import function. Authenticated attackers with administrator-level access can delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lsd[remark]' parameter in all versions up to, and including, 6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users because the listing-creation branch of the AJAX handler omits a capability check, and the required nonce is publicly emitted on any page containing the [listdom-dashboard] shortcode.

The Listdom plugin for WordPress up to version 5.8.1 is vulnerable to stored cross-site scripting via the 'lsd[displ][style]' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts on pages that will execute whenever a user accesses an injected page. Exploitation requires the Listdom Pro add-on to be active and the 'Display Options Per Listing' setting enabled.

The Listdom plugin (Webilia Inc.) up to version 5.0.1 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.