What is the CVSS score of CVE-2026-42658?

CVE-2026-42658 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Classified Listing are affected by CVE-2026-42658?

The Classified Listing WordPress plugin (versions ≤5.3.8) contains an unauthenticated cross-site scripting vulnerability (CVSS 7.1) enabling attackers to inject arbitrary JavaScript affecting website…

How to fix or mitigate CVE-2026-42658?

Within 24 hours: Identify all WordPress installations with Classified Listing plugin version 5.3.8 or earlier and assess public accessibility scope. Review access logs for exploitation indicators. Within 7 days: Deploy Web Application Firewall (WAF) rules blocking common XSS attack patterns; implement Content Security Policy (CSP) headers restricting script execution origins; enable continuous monitoring of affected plugin activity. Within 30 days: Evaluate alternative classified ad plugins as long-term remediation; if continued plugin use is required, conduct comprehensive security code review of user input handling and accelerate timeline for transition.

Classified Listing CVE-2026-42658

EUVD-2026-36823 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-15 Patchstack

GHSA-8gjj-f8v8-88pg

XSS Classified Listing

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable unauthenticated XSS (AV:N/AC:L/PR:N) needing victim click (UI:R); script runs in broader WordPress context so S:C with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:00 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.3.8 versions.

AnalysisAI

Unauthenticated reflected/stored Cross-Site Scripting in the Classified Listing WordPress plugin versions 5.3.8 and earlier allows remote attackers to inject arbitrary JavaScript that executes in a victim's browser after user interaction. The flaw was reported by Patchstack and carries CVSS 7.1 due to the scope change affecting the broader WordPress site context, though no public exploit identified at time of analysis. Risk is elevated for sites running the plugin in publicly accessible classified/marketplace deployments where untrusted visitor input is processed.

Technical ContextAI

Classified Listing is a WordPress plugin by author Mamunur Rashid (CPE cpe:2.3:a:mamunur_rashid:classified_listing) that turns a WordPress site into a classifieds/marketplace platform supporting listings, categories, and user submissions. The underlying weakness is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controlled input is rendered into HTML output without adequate encoding or sanitization, letting attacker-supplied markup execute as script in the DOM. Because the plugin accepts data from unauthenticated visitors (a core feature of classifieds platforms), the injection surface is exposed without prior login.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed from the provided data, so administrators should upgrade Classified Listing to the latest version above 5.3.8 as published on the WordPress.org plugin repository and verify via the Patchstack entry at https://patchstack.com/database/wordpress/plugin/classified-listing/vulnerability/wordpress-classified-listing-plugin-5-3-8-cross-site-scripting-xss-vulnerability. Until patched, compensating controls include placing the site behind a WAF with XSS rules (e.g., Patchstack, Wordfence) tuned for Classified Listing endpoints, restricting unauthenticated submission forms via reCAPTCHA or login-required gating (trade-off: reduces classifieds functionality for visitors), and setting a strict Content-Security-Policy header that disallows inline scripts and limits script-src to trusted origins (trade-off: may break themes or plugins relying on inline JavaScript and requires testing). Administrators should also avoid clicking unsolicited links to the affected site while a patch is pending, since exploitation requires user interaction.