Description

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter in all versions up to, and including, 5.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Listdom Pro add-on to be active and the 'Display Options Per Listing' displ setting to be enabled, both of which are non-default configurations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-01T05:17:09.360Z",
  "pubdate": "2026-09-01T05:17:09.360Z",
  "executiveSummary": "The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper input sanitization and output escaping. This flaw resides within the 'lsd[displ][style]' parameter.\nThe vulnerability allows unauthenticated attackers to inject malicious JavaScript into web pages rendered by the plugin. When an administrator or other user visits the compromised page, the injected script executes within the context of their session. This can lead to unauthorized actions, session hijacking, or the theft of sensitive session cookies.\nThe exploit requires specific environmental conditions to be met: the Listdom Pro add-on must be active, and the 'Display Options Per Listing' setting must be explicitly enabled. While these represent non-default configurations, they significantly increase the attack surface if utilized. Given the nature of Stored XSS, the impact is critical for sites using the vulnerable configuration, as the malicious payload persists on the server and executes automatically upon page retrieval.",
  "technicalDetails": "The vulnerability is classified as Stored Cross-Site Scripting (XSS), stemming from the application's failure to adequately sanitize user-supplied data passed through the 'lsd[displ][style]' parameter before storing it in the database and subsequently reflecting it back to the client side.\nThe vulnerable component is the processing logic for the 'Display Options Per Listing' feature within the Listdom Pro add-on. Because the plugin does not implement rigorous input validation or context-aware output encoding, arbitrary HTML and JavaScript tags can be successfully injected and stored.\nThe attack flow begins with an unauthenticated attacker identifying an endpoint that processes the 'lsd[displ][style]' parameter. By submitting a crafted HTTP request containing malicious payload sequences (e.g., <script>alert(document.cookie)</script>), the attacker causes the server to persist this payload within the database. The vulnerability exists because the application reflects this input directly into the Document Object Model (DOM) of the rendered page without appropriate escaping, such as converting special characters into HTML entities.\nUpon a user, such as an authenticated administrator or a regular visitor, navigating to the page where the injected listing is displayed, the browser interprets the stored string as executable code. Because the script originates from the same domain, it operates with the privileges of the victim's session, bypassing Same-Origin Policy (SOP) restrictions.\nThe impact of successful exploitation is broad. Once the malicious payload executes in the victim's browser, the attacker can perform actions on behalf of the user, including modifying site settings, creating new administrative accounts, or capturing session tokens to facilitate account takeover. The reliance on non-default configurations—specifically the activation of the Listdom Pro add-on and the enabled state of 'Display Options Per Listing'—serves as a bottleneck for exploitation but does not mitigate the severity for affected deployments.\nThis issue affects all versions of the Listdom plugin up to, and including, 5.8.1. The lack of an established sanitization layer for the aforementioned parameter allows for persistent, multi-user impact, necessitating immediate intervention to prevent unauthorized script execution."
}