CVE-2026-19796

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to stored cross-site scripting through the 'lsd[displ][style]' parameter, caused by insufficient input sanitization and output escaping in all versions up to and including 5.8.1. An unauthenticated attacker can inject arbitrary web scripts into pages, and those scripts execute whenever a user visits an affected page. This allows the attacker to run JavaScript in the browsers of site visitors, which can lead to session hijacking, redirects, or other client-side actions. Only sites running the Listdom Pro add-on with the non-default 'Display Options Per Listing' (displ) setting enabled are affected. There is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and current exploitation probability is low (EPSS ~0.2%).

What to do: Update the Listdom plugin to the latest patched release as soon as it is available (any version later than 5.8.1). As interim mitigation, sites that do not need the feature can disable the 'Display Options Per Listing' (displ) setting or deactivate the Listdom Pro add-on. Administrators should also check directory listing pages for unexpected or injected scripts.