What is the CVSS score of CVE-2026-57344?

CVE-2026-57344 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Classified Listing are affected by CVE-2026-57344?

The Classified Listing WordPress plugin (RadiusTheme) versions 5.4.2 and earlier contains an unauthenticated cross-site scripting vulnerability that allows attackers to inject malicious code into…

How to fix or mitigate CVE-2026-57344?

Within 24 hours: Inventory all WordPress instances to identify deployments of Classified Listing plugin versions 5.4.2 and earlier. Within 7 days: Either disable the vulnerable plugin or implement compensating WAF controls (see below). Within 30 days: Monitor RadiusTheme advisories for patch release; upgrade to patched version immediately upon availability and test thoroughly before production deployment.

Classified Listing CVE-2026-57344

EUVD-2026-41344 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-f2xx-5vfj-7fv9

WordPress XSS Classified Listing Wordpress Plugin Radiustheme

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Unauthenticated network XSS needing victim interaction (UI:R) with browser-context script execution crossing scope (S:C), yielding low confidentiality/integrity impact and no genuine availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:13 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versions.

AnalysisAI

Cross-site scripting in the Classified Listing WordPress plugin (by RadiusTheme) versions 5.4.2 and earlier lets a remote, unauthenticated attacker inject malicious script that executes in a victim's browser when they interact with a crafted link or page. Reported by Patchstack and rated CVSS 7.1, the flaw carries a scope change (S:C) meaning the injected script can act beyond the vulnerable component into the wider browsing context. There is no public exploit identified at time of analysis and no active exploitation reported.

Technical ContextAI

The affected software is the Classified Listing plugin (CPE cpe:2.3:a:radiustheme:classified_listing) for WordPress, which provides classified-ad and directory functionality on WordPress sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), i.e. user-supplied input is reflected or stored and rendered into HTML output without adequate output encoding or input sanitization. Because the CVSS vector marks PR:N and UI:R, the injection point is reachable by an unauthenticated actor but requires a victim to interact (e.g. click a link or visit a crafted page) for the payload to fire in their session.

RemediationAI

No vendor-released patch version was identified in the provided data; the affected range is '<= 5.4.2', which implies remediation is to upgrade to the next release above 5.4.2 once confirmed via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/classified-listing/vulnerability/wordpress-classified-listing-plugin-5-4-2-cross-site-scripting-xss-vulnerability) and the RadiusTheme changelog - do not rely on an invented version number. Until a confirmed patched build is installed, compensating controls include deploying a WordPress-aware WAF or Patchstack's virtual patching to filter XSS payloads (trade-off: rule tuning and possible false positives), restricting or disabling the specific Classified Listing forms/endpoints that accept unauthenticated input if that functionality is not essential (trade-off: loss of public listing submission), and enforcing a strict Content-Security-Policy to reduce script execution impact (trade-off: may break legitimate inline scripts/themes and requires testing).