Listdom CVE-2026-96647

Exploitation requires an authenticated account on the target site and that the site renders the [listdom-dashboard] shortcode on a page - this is what publicly emits the nonce needed to call the AJAX listing-creation handler. Nominally contributor-level access is required, but the description confirms Subscriber-level users can exploit it because the listing-creation branch of the AJAX handler omits the capability check; this makes open user registration (common on directory/classifieds sites) the key enabling condition. Payload is injected via the 'lsd[remark]' parameter and stored. The limiting factors that reduce real-world risk: the site must allow registration (or the attacker must otherwise obtain any authenticated account), must use the dashboard shortcode, and the payload only fires when another user subsequently views the injected page (deferred, victim-dependent execution).

This is a stored XSS flaw (CWE-79) in the Listdom WordPress plugin with a provided CVSS 3.1 score of 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). The signals paint a moderate but credible risk. No EPSS score, KEV listing, or POC is present in the input, so by precision rules this is 'no public exploit identified at time of analysis' and there is NO evidence of active exploitation. The CVSS vector indicates network vector, low complexity, and only low privileges (PR:L), but the description materially LOWERS the effective privilege bar: although the vulnerability is nominally for contributor-level and above, it is actually reachable by Subscriber-level users because the listing-creation branch of the AJAX handler omits a capability check and the required nonce is publicly emitted on any page bearing the [listdom-dashboard] shortcode. That caveat means the real-world barrier is lower than PR:L alone suggests - Subscriber is the lowest authenticated WordPress tier and registration is frequently open on directory/classifieds sites. The scope change (S:C) plus the stored nature means injected script executes against any visitor, including administrators, which is the main escalation concern. Net: not a drop-everything critical, but a legitimately prioritizable issue on sites that allow open/Subscriber registration, undercut only by the lack of exploitation telemetry (no EPSS/KEV/POC in the data).

An attacker registers a free Subscriber account on a Listdom-powered directory site that exposes the [listdom-dashboard] shortcode, harvests the publicly emitted nonce from that page, and submits a listing-creation AJAX request with a malicious payload in the 'lsd[remark]' parameter. Because input sanitization and output escaping are insufficient and the capability check is missing, the script is stored and later executes in the browser of any user - including an administrator - who views the injected page. No public exploit code is identified in the provided data.