Listdom CVE-2026-19796

Exploitation requires two simultaneous non-default conditions: the Listdom Pro paid add-on must be installed and active, and the 'Display Options Per Listing' (displ) setting must be explicitly enabled in Listdom configuration - neither is present in a default install. Given the CVSS PR:N rating, no authentication is required to submit the malicious parameter once those conditions are satisfied. The attack is further gated by the requirement that a separate victim navigate to the injected listing page before the XSS payload fires - the attacker has no direct control over this second-stage trigger. Exploitation is limited to Listdom plugin versions 5.8.1 and earlier running on WordPress.

The published CVSS 7.2 overstates practical exploitation risk in two respects: AC:L does not account for the two non-default prerequisites the description explicitly names (Listdom Pro add-on plus displ setting), and UI:N is inconsistent with stored XSS mechanics, which require a victim to navigate to the injected page. Correcting to AC:H and UI:R would reduce the effective score to approximately 4.4 (medium). No EPSS data was provided and the vulnerability is absent from CISA KEV, leaving exploitation probability signals incomplete. The attack is not automatable at scale - an adversary must first identify a WordPress site where a paid Pro add-on is active and a non-default display option is toggled on, which substantially narrows the exposed population and limits opportunistic scanning campaigns. That said, once conditions are met, the stored XSS payload is persistent and self-executing for every page visitor without any further attacker action, making it high-impact against the qualifying subset of deployments.

An attacker identifies a WordPress site running Listdom Pro with the 'Display Options Per Listing' feature enabled, then submits a listing or display-style update containing a JavaScript payload in the lsd[displ][style] parameter. The unsanitized payload is stored in the WordPress database; when any visitor - including administrators - loads the affected listing page, the script executes in their browser context, enabling session cookie theft, credential harvesting, or silent redirection to a phishing site. No public exploit code has been identified at time of analysis.