Logo
Retour à la veille

CVE-2026-96647

Publié : 2 octobre 2026
Modifié : 2 octobre 2026
Lien officiel NVD
Score CVSS
6.4
MEDIUM

Description détaillée

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsd[remark]' Parameter in all versions up to, and including, 6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users because the listing-creation branch of the AJAX handler omits a capability check, and the required nonce is publicly emitted on any page containing the [listdom-dashboard] shortcode.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Références et Patchs

https://plugins.trac.wordpress.org/browser/listdom/tags/6.1.0/app/includes/entity/listing.php#L200https://plugins.trac.wordpress.org/browser/listdom/tags/6.1.0/app/includes/shortcodes/dashboard.php#L1420https://plugins.trac.wordpress.org/browser/listdom/tags/6.1.0/app/includes/shortcodes/dashboard.php#L210https://plugins.trac.wordpress.org/browser/listdom/tags/6.1.0/app/includes/shortcodes/dashboard.php#L972https://plugins.trac.wordpress.org/browser/listdom/tags/6.1.0/app/includes/template/elements/remark.php#L122https://plugins.trac.wordpress.org/changeset?reponame=&old=3711814%40listdom&new=3711814%40listdomhttps://www.wordfence.com/threat-intel/vulnerabilities/id/dc253ef6-8677-4651-adb9-725441cd171a?source=cve

Dernières Vulnérabilités

CVE-2026-96294

Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

VOIR DÉTAILS

CVE-2026-96292

Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

VOIR DÉTAILS

CVE-2026-96288

Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

VOIR DÉTAILS