Mamunur Rashid
Monthly
Unauthenticated reflected/stored Cross-Site Scripting in the Classified Listing WordPress plugin versions 5.3.8 and earlier allows remote attackers to inject arbitrary JavaScript that executes in a victim's browser after user interaction. The flaw was reported by Patchstack and carries CVSS 7.1 due to the scope change affecting the broader WordPress site context, though no public exploit identified at time of analysis. Risk is elevated for sites running the plugin in publicly accessible classified/marketplace deployments where untrusted visitor input is processed.
Missing authorization in the Classified Listing WordPress plugin (≤6.1.1) allows authenticated low-privileged users to invoke restricted plugin functionality without the required capability checks. Reported by Patchstack with a CVSS 5.4 medium score, the flaw falls under CWE-862 (Missing Authorization), meaning the plugin fails to verify whether the requesting user holds the appropriate ACL permissions before executing sensitive actions. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Broken access control in the Classified Listing WordPress plugin (versions ≤ 5.3.9) allows subscriber-level authenticated users to perform actions that should be restricted to higher-privileged roles, yielding partial confidentiality, integrity, and availability impact. Reported by Patchstack and tracked under ENISA EUVD-2026-36819, the flaw stems from missing authorization checks (CWE-862) within plugin functionality accessible to the lowest default WordPress user role. No public exploit identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog.
Broken Access Control in the Classified Listing WordPress plugin (versions ≤ 5.3.8) allows unauthenticated remote attackers to bypass authorization checks, enabling limited read and write access to plugin-managed listing data without any credentials. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is network-exploitable against any internet-exposed WordPress installation running the affected plugin with no authentication or user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in the Classified Listing WordPress plugin (versions through 5.3.8) enables authenticated low-privileged users to download arbitrary files from the server filesystem. The vulnerability, reported by Patchstack as an arbitrary file download flaw, exposes full confidentiality impact (C:H) with no integrity or availability consequence, meaning attackers can exfiltrate sensitive server files - including wp-config.php, credentials, or private data - but cannot modify or destroy them. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Unauthenticated reflected/stored Cross-Site Scripting in the Classified Listing WordPress plugin versions 5.3.8 and earlier allows remote attackers to inject arbitrary JavaScript that executes in a victim's browser after user interaction. The flaw was reported by Patchstack and carries CVSS 7.1 due to the scope change affecting the broader WordPress site context, though no public exploit identified at time of analysis. Risk is elevated for sites running the plugin in publicly accessible classified/marketplace deployments where untrusted visitor input is processed.
Missing authorization in the Classified Listing WordPress plugin (≤6.1.1) allows authenticated low-privileged users to invoke restricted plugin functionality without the required capability checks. Reported by Patchstack with a CVSS 5.4 medium score, the flaw falls under CWE-862 (Missing Authorization), meaning the plugin fails to verify whether the requesting user holds the appropriate ACL permissions before executing sensitive actions. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Broken access control in the Classified Listing WordPress plugin (versions ≤ 5.3.9) allows subscriber-level authenticated users to perform actions that should be restricted to higher-privileged roles, yielding partial confidentiality, integrity, and availability impact. Reported by Patchstack and tracked under ENISA EUVD-2026-36819, the flaw stems from missing authorization checks (CWE-862) within plugin functionality accessible to the lowest default WordPress user role. No public exploit identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog.
Broken Access Control in the Classified Listing WordPress plugin (versions ≤ 5.3.8) allows unauthenticated remote attackers to bypass authorization checks, enabling limited read and write access to plugin-managed listing data without any credentials. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is network-exploitable against any internet-exposed WordPress installation running the affected plugin with no authentication or user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in the Classified Listing WordPress plugin (versions through 5.3.8) enables authenticated low-privileged users to download arbitrary files from the server filesystem. The vulnerability, reported by Patchstack as an arbitrary file download flaw, exposes full confidentiality impact (C:H) with no integrity or availability consequence, meaning attackers can exfiltrate sensitive server files - including wp-config.php, credentials, or private data - but cannot modify or destroy them. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.