CVE-2026-96647 describes a stored Cross-Site Scripting vulnerability in the Listdom: AI-powered Business Directory with Classifieds Ads Listings WordPress plugin. The vulnerability arises from insufficient input sanitization and output escaping of the 'lsd[remark]' parameter in all versions up to and including 6.1.1. Authenticated attackers with contributor-level privileges or higher can inject arbitrary web scripts into pages, which execute upon page access. Additionally, subscriber-level users can exploit the flaw because the AJAX handler for listing creation lacks proper capability checks and the required nonce is publicly available on pages containing the [listdom-dashboard] shortcode.

Successful exploitation allows attackers to execute arbitrary scripts in the context of affected users, potentially leading to session hijacking, defacement, or other malicious actions. The vulnerability affects confidentiality and integrity but does not impact availability. Both contributor-level and subscriber-level authenticated users can exploit this issue due to missing access controls and nonce exposure.

No official patch or fix is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates. In the meantime, restrict user roles to trusted individuals and avoid exposing the [listdom-dashboard] shortcode on publicly accessible pages to reduce risk. Implementing additional input validation and output escaping on the 'lsd[remark]' parameter can help mitigate exploitation.