Listdom
Monthly
Stored Cross-Site Scripting in the Listdom WordPress plugin (all versions through 5.8.1) allows unauthenticated attackers to inject persistent malicious scripts via the `lsd[displ][style]` parameter, with payloads executing in every subsequent visitor's browser upon page load. The CVSS PR:N rating confirms no authentication is required to plant the payload once the vulnerable parameter is reachable. Wordfence identified the vulnerable code across four paths - single.php (lines 82 and 560), dashboard.php (line 739), and listing.php (line 196) - and a Trac changeset suggests a code-level fix was committed, though an explicit patched release version number is not confirmed in available data. No public exploit identified at time of analysis.
Unauthenticated SQL injection in the Listdom WordPress plugin (Webilia) through version 5.6.0 lets remote attackers inject arbitrary SQL into backend database queries without any authentication or user interaction. Reported by Patchstack and rated CVSS 9.3, it primarily threatens the confidentiality of the WordPress database (user credentials, session data, private listings). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Blind SQL injection in Webilia's Listdom WordPress plugin (versions up to and including 5.4.0) allows remote unauthenticated attackers to inject SQL fragments into back-end queries and extract data inferentially. The flaw carries a 9.3 CVSS score with a scope change (S:C), indicating the injection can affect resources beyond the vulnerable component. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated privilege escalation in the Listdom WordPress plugin versions 5.5.0 and earlier allows remote attackers to elevate privileges without any authentication or user interaction. The flaw is tracked under CWE-266 (Incorrect Privilege Assignment) and was reported by Patchstack; no public exploit identified at time of analysis. Affected sites running this Webilia-developed directory listing plugin face risk of unauthorized account or capability elevation through exposed plugin endpoints.
Stored Cross-Site Scripting in the Listdom WordPress plugin (all versions through 5.8.1) allows unauthenticated attackers to inject persistent malicious scripts via the `lsd[displ][style]` parameter, with payloads executing in every subsequent visitor's browser upon page load. The CVSS PR:N rating confirms no authentication is required to plant the payload once the vulnerable parameter is reachable. Wordfence identified the vulnerable code across four paths - single.php (lines 82 and 560), dashboard.php (line 739), and listing.php (line 196) - and a Trac changeset suggests a code-level fix was committed, though an explicit patched release version number is not confirmed in available data. No public exploit identified at time of analysis.
Unauthenticated SQL injection in the Listdom WordPress plugin (Webilia) through version 5.6.0 lets remote attackers inject arbitrary SQL into backend database queries without any authentication or user interaction. Reported by Patchstack and rated CVSS 9.3, it primarily threatens the confidentiality of the WordPress database (user credentials, session data, private listings). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Blind SQL injection in Webilia's Listdom WordPress plugin (versions up to and including 5.4.0) allows remote unauthenticated attackers to inject SQL fragments into back-end queries and extract data inferentially. The flaw carries a 9.3 CVSS score with a scope change (S:C), indicating the injection can affect resources beyond the vulnerable component. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated privilege escalation in the Listdom WordPress plugin versions 5.5.0 and earlier allows remote attackers to elevate privileges without any authentication or user interaction. The flaw is tracked under CWE-266 (Incorrect Privilege Assignment) and was reported by Patchstack; no public exploit identified at time of analysis. Affected sites running this Webilia-developed directory listing plugin face risk of unauthorized account or capability elevation through exposed plugin endpoints.