Threat database

The Listdom plugin for WordPress, versions up to and including 6.1.2, contains a path traversal vulnerability in the LSD_Menus_IX_CSV::import function. This flaw allows authenticated users with administrator-level privileges to delete arbitrary files on the server by exploiting insufficient file path validation. Deleting critical files such as wp-config.php could lead to remote code execution. The vulnerability has a medium severity rating with a CVSS score of 4.9.

The Listdom WordPress plugin up to version 6.1.1 contains a stored cross-site scripting (XSS) vulnerability via the 'lsd[remark]' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. Subscriber-level users can also exploit this due to a missing capability check in an AJAX handler and a publicly exposed nonce on pages with the [listdom-dashboard] shortcode. The vulnerability arises from insufficient input sanitization and output escaping.

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter in all versions up to, and including, 5.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Listdom Pro add-on to be active and the 'Display Options Per Listing' displ setting to be enabled, both of which are non-default configurations.

Unauthenticated SQL Injection in Listdom <= 5.6.0 versions.

CVE-2026-54819 is a critical SQL Injection vulnerability in Webilia Inc.'s Listdom product affecting versions up to and including 5.4.0. The flaw allows an attacker to perform Blind SQL Injection due to improper neutralization of special elements in SQL commands. This vulnerability has a high CVSS score of 9.3, indicating critical severity with high confidentiality impact and low availability impact. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

Unauthenticated Privilege Escalation in Listdom <= 5.5.0 versions.

The Vertex Addons for Elementor WordPress plugin up to version 1.6.4 contains a missing authorization vulnerability in the activate_required_plugins() function. The plugin improperly enforces the current_user_can('install_plugins') check by only setting an error message without halting execution, allowing authenticated users with Subscriber-level access or higher to install and activate arbitrary plugins. This vulnerability has a high severity with a CVSS score of 8.8. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

Missing Authorization vulnerability in Webilia Inc. Vertex Addons for Elementor addons-for-elementor-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Vertex Addons for Elementor: from n/a through <= 1.6.4.

Missing Authorization vulnerability in Webilia Inc. Listdom listdom allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Listdom: from n/a through <= 5.0.1.

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Webilia Inc. Listdom listdom allows Phishing.This issue affects Listdom: from n/a through <= 4.0.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webilia Inc. Vertex Addons for Elementor addons-for-elementor-builder allows Stored XSS.This issue affects Vertex Addons for Elementor: from n/a through <= 1.2.0.

The Listdom – Business Directory and Classified Ads Listings WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.