EUVD-2026-41344
GHSA-f2xx-5vfj-7fv9
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network XSS needing victim interaction (UI:R) with browser-context script execution crossing scope (S:C), yielding low confidentiality/integrity impact and no genuine availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versions.
AnalysisAI
Cross-site scripting in the Classified Listing WordPress plugin (by RadiusTheme) versions 5.4.2 and earlier lets a remote, unauthenticated attacker inject malicious script that executes in a victim's browser when they interact with a crafted link or page. Reported by Patchstack and rated CVSS 7.1, the flaw carries a scope change (S:C) meaning the injected script can act beyond the vulnerable component into the wider browsing context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the Classified Listing plugin (RadiusTheme) at version 5.4.2 or earlier to be installed and reachable, and - per the CVSS UI:R flag - a victim must interact with attacker-controlled content (click a crafted link or view a page containing the injected payload) for the script to execute. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are moderate and partially incomplete. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a URL or listing submission containing a JavaScript payload targeting the vulnerable input in Classified Listing and lures a site visitor or administrator to open it. When the victim's browser renders the unsanitized content, the script executes in their session context, enabling session/cookie theft, redirection, or actions on the user's behalf. … |
| Remediation | No vendor-released patch version was identified in the provided data; the affected range is '<= 5.4.2', which implies remediation is to upgrade to the next release above 5.4.2 once confirmed via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/classified-listing/vulnerability/wordpress-classified-listing-plugin-5-4-2-cross-site-scripting-xss-vulnerability) and the RadiusTheme changelog - do not rely on an invented version number. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all WordPress instances to identify deployments of Classified Listing plugin versions 5.4.2 and earlier. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Classified Listing
View allThe Classified Listing Pro WordPress plugin before 2.0.20 does not escape a generated URL before outputting it back in a
The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classifie
The Classified Listing - Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Cross-Site Req
Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme Classified Listing plugin <= 2.4.5 versions. Rated high s
Unauthenticated reflected/stored Cross-Site Scripting in the Classified Listing WordPress plugin versions 5.3.8 and earl
The Classified Listing - Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized a
Broken access control in the Classified Listing WordPress plugin (versions <= 5.4.2) allows subscriber-level authenticat
Broken Access Control in the Classified Listing WordPress plugin (versions ≤ 5.3.8) allows unauthenticated remote attack
Path traversal in the Classified Listing WordPress plugin (versions through 5.3.8) enables authenticated low-privileged
Broken access control in the Classified Listing WordPress plugin (versions ≤ 5.3.9) allows subscriber-level authenticate
The Classified Listing - Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Sensitive Info
The Classified Listing - Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized l
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today