CVE-2026-94665
MediumCVSS 6.5Summary
The Mamunur Rashid Classified Listing (classified-listing) plugin contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from n/a through 6.1.2.
Risk Assessment
An attacker could store a malicious script that executes in other users' browsers, potentially leading to session theft or account takeover.
Recommendation
Update Classified Listing to a version later than 6.1.2 or apply available mitigations, and consider deploying CSP headers.
Other vulnerabilities in Classified Listing
See all- CVE-2026-96351High
Unauthenticated Cross Site Scripting (XSS) vulnerability in Classified Listing up to version 6.1.3.
- CVE-2026-57355Medium
The Classified Listing plugin for WordPress versions 5.4.2 and earlier contains a broken access control vulnerability exploitable by subscribers. This allows users with the subscriber role to perform unauthorized actions.
- CVE-2026-57344High
The Classified Listing plugin for WordPress versions 5.4.2 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. This allows an attacker to inject malicious JavaScript code without requiring authentication.
- CVE-2026-84217Medium
Missing Authorization vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Classified Listing from n/a through 6.1.3.
- CVE-2026-16276Low
The 'Classified Listing' WordPress plugin before version 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted to administrators and report managers.
- CVE-2026-16274Low
The 'Classified Listing' WordPress plugin before version 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts, pending, and private posts owned by other users — regardless of ownership.
- CVE-2026-14183Medium
Vulnerability in the Classified Listing WordPress plugin (before version 5.3.9). Allows authenticated users with subscriber-level access to read payment receipt details of other users' orders, as the plugin does not verify that the order belongs to the requesting user.
- CVE-2026-42658High
Versions of Classified Listing up to 5.3.8 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
- CVE-2026-42651Medium
Classified Listing versions up to 5.3.9 have a vulnerability in access control that may allow unauthorized subscribers to access resources.
- CVE-2026-42640Medium
Classified Listing versions up to 5.3.8 have a vulnerability in access control that allows unauthorized access.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid Classified Listing classified-listing allows Stored XSS.This issue affects Classified Listing: from n/a through 6.1.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS