CVE-2026-84217

The Classified Listing plugin for WordPress versions 5.4.2 and earlier contains a broken access control vulnerability exploitable by subscribers. This allows users with the subscriber role to perform unauthorized actions.

The Classified Listing plugin for WordPress versions 5.4.2 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. This allows an attacker to inject malicious JavaScript code without requiring authentication.

The 'Classified Listing' WordPress plugin before version 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted to administrators and report managers.

The 'Classified Listing' WordPress plugin before version 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts, pending, and private posts owned by other users — regardless of ownership.

Vulnerability in the Classified Listing WordPress plugin (before version 5.3.9). Allows authenticated users with subscriber-level access to read payment receipt details of other users' orders, as the plugin does not verify that the order belongs to the requesting user.

Versions of Classified Listing up to 5.3.8 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.

Classified Listing versions up to 5.3.9 have a vulnerability in access control that may allow unauthorized subscribers to access resources.

Classified Listing versions up to 5.3.8 have a vulnerability in access control that allows unauthorized access.

Path Traversal vulnerability in the Classified Listing plugin (WordPress) through version 5.3.8. Allows an attacker to access files outside the restricted directory.