Classified Listing EUVD-2026-89864

Exploitation requires the WordPress site to run the Classified Listing plugin (by radiustheme) at version 6.1.3 or earlier, with a public-facing input path (e.g. a listing submission or form field) that reaches the vulnerable sink. No authentication is needed (PR:N), but the attack is not self-contained: it requires user interaction (UI:R) - a victim, typically an administrator or another site user, must view the page containing the injected payload for the script to execute. Sites that restrict who can submit listings or that have upgraded past 6.1.3 are not exposed.

The CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) describes a network-reachable, low-complexity, unauthenticated stored/reflected XSS whose scope change (S:C) reflects script executing in the browser context of a victim who is served the page, with limited confidentiality, integrity, and availability impact each. Because PR:N confirms no authentication is required and the vulnerability class (CWE-79) targets other users, the realistic worst case is compromise of a logged-in administrator's session via script execution, but this depends on UI:R (an admin or user must view the injected content). There is no EPSS score, no CISA KEV listing, and no public proof-of-concept provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this is a credible but not urgently weaponized issue. No SSVC decision data was supplied. The signals are internally consistent (network XSS requiring victim interaction), so no metric conflicts need flagging, though the exact injection sink and whether it is stored or reflected are not specified in the sparse description - verify against the Patchstack advisory before prioritizing.

An unauthenticated attacker submits a crafted classified listing or form field containing a malicious script payload that the Classified Listing plugin fails to sanitize. When a site administrator or another visitor views the affected listing or admin page, the script executes in their browser under the site's origin, enabling session/cookie theft or admin-context actions. No public proof-of-concept is available at time of analysis.