Listdom vulnerabilities
3 known CVE vulnerabilities in Listdom, translated and rated.
- CVE-2026-19796High
The Listdom plugin for WordPress up to version 5.8.1 is vulnerable to stored cross-site scripting via the 'lsd[displ][style]' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts on pages that will execute whenever a user accesses an injected page. Exploitation requires the Listdom Pro add-on to be active and the 'Display Options Per Listing' setting enabled.
- CVE-2026-61969Critical
Unauthenticated SQL Injection vulnerability in Listdom versions up to 5.6.0. An attacker can execute arbitrary SQL queries without authentication.
- CVE-2026-49063High
Listdom versions up to 5.5.0 contain a vulnerability that allows unauthenticated privilege escalation.