This vulnerability (CVE-2026-56046) is classified as CWE-79, indicating improper neutralization of input during web page generation leading to Cross-Site Scripting (XSS). It affects ListingPro versions up to 2.9.11. The CVSS 3.1 base score is 6.5 (medium), with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts confidentiality, integrity, and availability at a low level. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker with subscriber-level privileges to execute arbitrary scripts in the context of other users, potentially leading to information disclosure, modification of data, or disruption of service. The impact is rated medium based on the CVSS score and the described confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor vendor channels for updates and apply patches promptly once available.