CVE-2026-19796

Name of the Vulnerable Software and Affected Versions Listdom: AI-powered Business Directory with Classifieds Ads Listings versions prior to 5.8.2

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. This occurs via the lsd[displ][style] parameter. The issue is exploitable when the Listdom Pro add-on is active and the 'Display Options Per Listing' displ setting is enabled.

Recommendations Update to version 5.8.2 or later. As a temporary mitigation, disable the 'Display Options Per Listing' displ setting or deactivate the Listdom Pro add-on.