CVE-2026-19796: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in webilia Listdom: AI-powered Business Directory with Classifieds Ads Listings

CVE-2026-19796 describes a stored cross-site scripting vulnerability in the Listdom: AI-powered Business Directory with Classifieds Ads Listings WordPress plugin. The flaw exists in the handling of the 'lsd[displ][style]' parameter, which lacks proper input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when users access the affected pages. Exploitation conditions include the activation of the Listdom Pro add-on and enabling the 'Display Options Per Listing' displ setting, both of which are not enabled by default. The vulnerability affects all versions up to and including 5.8.1. No official patch or remediation guidance is currently provided.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim user's browser, potentially resulting in data theft, session hijacking, or other malicious actions. The vulnerability requires no privileges and no user interaction, increasing its risk. However, exploitation depends on non-default configurations, limiting exposure. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the Listdom Pro add-on or the 'Display Options Per Listing' displ setting to mitigate risk. Monitoring for updates from the vendor is recommended.