CVE-2026-19796 Overview
CVE-2026-19796 is a Stored Cross-Site Scripting (XSS) vulnerability in the Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress. The flaw affects all versions up to and including 5.8.1. It results from insufficient input sanitization and output escaping on the lsd[displ][style] parameter. Unauthenticated attackers can inject arbitrary web scripts that execute when users visit an affected page. Exploitation requires the Listdom Pro add-on to be active and the Display Options Per Listing (displ) setting to be enabled, both of which are non-default configurations.
Critical Impact
Unauthenticated attackers can inject persistent JavaScript into WordPress pages, enabling session theft, credential harvesting, and redirection of site visitors to attacker-controlled infrastructure.
Affected Products
- Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress (all versions ≤ 5.8.1)
- Listdom Pro add-on (required for exploitation)
- WordPress sites with Display Options Per Listing enabled
Discovery Timeline
- 2026-09-01 - CVE-2026-19796 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-19796
Vulnerability Analysis
The vulnerability is a stored Cross-Site Scripting flaw classified under CWE-79. The Listdom plugin accepts the lsd[displ][style] request parameter and persists its contents without applying adequate input sanitization. When the affected listing pages render, the plugin outputs the stored value without proper HTML escaping. This allows attacker-supplied markup and JavaScript to execute in the browser of any user viewing the page.
Because the payload is stored server-side, every visitor to the affected listing becomes a potential target. The scope change in the vulnerability metadata reflects that injected scripts run in the context of the vulnerable WordPress site and can affect authenticated administrators, editors, and unauthenticated visitors alike.
Root Cause
The root cause is missing sanitization on input and missing escaping on output for the style sub-key within the lsd[displ] array parameter. The vulnerable code paths reside in the plugin's listing entity and single-listing template handlers, including app/includes/entity/listing.php and app/includes/ptypes/listing/single.php. The plugin does not enforce an allowlist on the style value nor apply esc_attr() or esc_html() before rendering.
Attack Vector
An unauthenticated remote attacker submits a request containing a malicious lsd[displ][style] value to a page that accepts the parameter. The payload is stored by the plugin and subsequently rendered without escaping. When any user, including administrators, browses the affected listing, the injected script executes with the site's origin, enabling actions such as cookie theft, session riding, or forced administrative actions via CSRF chains. See the Wordfence Vulnerability Analysis for additional detail on the affected code paths.
No verified public proof-of-concept code is available; refer to the WordPress ListDom Changeset for the corrective diff.
Detection Methods for CVE-2026-19796
Indicators of Compromise
- HTTP requests containing lsd[displ][style] parameter values with <script>, onerror=, onload=, or javascript: tokens
- Listing pages rendering unexpected <script> tags or inline event handlers inside display-style attributes
- Unauthorized administrative actions or new administrator accounts created shortly after suspicious listing traffic
- Outbound requests from visitor browsers to unknown domains referenced by injected payloads
Detection Strategies
- Inspect WordPress access logs for POST and GET requests referencing lsd[displ] array parameters from unauthenticated sources
- Review stored listing metadata in the WordPress database for HTML tags or JavaScript keywords in Listdom display option fields
- Deploy a Web Application Firewall (WAF) rule that blocks script-tag patterns in Listdom-specific parameters
Monitoring Recommendations
- Monitor for changes to WordPress user roles and creation of new administrator accounts
- Alert on outbound connections from web server processes to unfamiliar domains
- Track file modifications under wp-content/plugins/listdom/ for signs of secondary compromise
How to Mitigate CVE-2026-19796
Immediate Actions Required
- Update the Listdom plugin to a version later than 5.8.1 as soon as a fixed release is available from the plugin author
- Disable the Display Options Per Listing (displ) setting until the plugin is patched
- Deactivate the Listdom Pro add-on on sites that do not require its functionality
- Audit existing listings for stored HTML or JavaScript content in Listdom display fields and remove suspicious entries
Patch Information
The vendor addressed the issue in the commit referenced by the WordPress ListDom Changeset. Site administrators should apply the corresponding plugin update through the WordPress dashboard or via WP-CLI. Verify the installed version is greater than 5.8.1 after updating.
Workarounds
- Disable the Listdom Pro add-on to break the exploitation prerequisite
- Turn off the Display Options Per Listing toggle in the Listdom settings panel
- Deploy WAF signatures that block script or event-handler content in the lsd[displ][style] parameter
- Restrict access to Listdom endpoints via IP allowlists where feasible
# WP-CLI command to verify Listdom plugin version and disable the Pro add-on
wp plugin get listdom --field=version
wp plugin deactivate listdom-pro
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
