CVE-2026-61969
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Unauthenticated SQL Injection vulnerability in Listdom versions up to 5.6.0. An attacker can execute arbitrary SQL queries without authentication.
Risk Assessment
Risk includes unauthorized access to the database, potentially leading to data leakage, modification, or deletion.
Recommendation
Update the plugin to the latest patched version. Restrict access to the admin panel and monitor logs for suspicious queries.
Other vulnerabilities in Listdom
See all- CVE-2026-19796High
The Listdom plugin for WordPress up to version 5.8.1 is vulnerable to stored cross-site scripting via the 'lsd[displ][style]' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts on pages that will execute whenever a user accesses an injected page. Exploitation requires the Listdom Pro add-on to be active and the 'Display Options Per Listing' setting enabled.
- CVE-2026-49063High
Listdom versions up to 5.5.0 contain a vulnerability that allows unauthenticated privilege escalation.
Original NVD description (English source)
Unauthenticated SQL Injection in Listdom <= 5.6.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS