Classified Listing CVE-2026-94665

Exploitation requires an authenticated account on the target WordPress site with enough privilege to create or edit a classified listing (PR:L), and it requires a victim - typically an administrator or another user - to subsequently view the listing or admin page where the unsanitized input is rendered (UI:R). Payload persistence depends on the Classified Listing plugin (versions up to and including 6.1.2) being installed and the vulnerable listing field being reachable by the attacker's role; sites that restrict listing submission to trusted users or that do not render the affected field to privileged viewers meaningfully limit practical impact. This is not remote-unauthenticated: both a login and victim interaction are mandatory.

This is a moderate-risk, low-urgency issue consistent with a typical authenticated Stored XSS in a WordPress plugin. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, base 6.5) indicates a network-reachable, low-complexity attack requiring low privileges (PR:L - an authenticated account) and victim interaction (UI:R). The scope change (S:C) reflects script executing in another user's browser context, and the three Low impacts are the limited C/I/A effects typical of XSS. No EPSS score, SSVC decision, KEV listing, or public POC was provided in the input, so there is no signal of active or probable exploitation. There is no conflict between the CVSS vector and the description - both point to authenticated stored injection requiring an administrator or other user to view the payload. Overall this is a genuine but routine vulnerability to remediate on a normal patch cycle, not an emergency; it is not a high-CVSS-but-illusory issue, but neither is there evidence elevating it above standard WordPress-plugin XSS hygiene.

An attacker holding a low-privileged account (e.g., a contributor or listing author) submits a classified listing containing a malicious script payload in a field that is stored without proper neutralization. When an administrator or other user later views that listing or the related admin screen, the script executes in their browser, enabling session or action abuse in the victim's context. No public exploit code was identified at time of analysis.