CVE-2026-94665— WordPress Classified Listing plugin <= 6.1.2 - Cross Site Scripting (XSS) vulnerability
Quick assessment
Affected
Mamunur Rashid Classified Listing
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Mamunur Rashid 的 Classified Listing（classified-listing）插件中，存在网页生成过程中输入中和不当的问题，导致“跨站脚本攻击”（Cross-site Scripting, XSS）漏洞。该问题属于存储型跨站脚本攻击（Stored XSS）。受影响的 Classified Listing 版本范围为：从初始版本至 6.1.2。
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by CompromiseAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Mamunur Rashid | Classified Listing | ≤ 6.1.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-94665
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Classified Listing plugin <= 6.1.2 - Cross Site Scripting (XSS) vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid Classified Listing classified-listing allows Stored XSS.This issue affects Classified Listing: from n/a through 6.1.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Mamunur Rashid | Classified Listing | 0 ~ 6.1.2 | - |
|
II. Public POCs for CVE-2026-94665
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-94665
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: Classified Listing
-
CVE-2026-96351
WordPress Classified Listing plugin <= 6.1.3 - Cross Site Sc -
CVE-2026-16281
Classified Listing < 6.1.1 - Subscriber+ Arbitrary Attachmen -
CVE-2026-84217
WordPress Classified Listing plugin <= 6.1.3 - Broken Access -
CVE-2026-16276
Classified Listing < 5.4.4 - Contributor+ Store Revenue Tota -
CVE-2026-16274
Classified Listing < 5.4.4 - Contributor+ Unpublished Post C
Same vendor: Mamunur Rashid
-
CVE-2026-95596
WordPress ShopBuilder – Elementor WooCommerce Builder Addons -
CVE-2026-97280
WordPress Review Schema plugin 3.1.0 - Broken Access Control -
CVE-2026-84217
WordPress Classified Listing plugin <= 6.1.3 - Broken Access -
CVE-2026-42658
WordPress Classified Listing plugin <= 5.3.8 - Cross Site Sc -
CVE-2026-42651
WordPress Classified Listing plugin <= 5.3.9 - Broken Access
Same weakness: CWE-79
-
CVE-2026-103427
Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Sto -
CVE-2026-96572
WP Meteor Website Speed Optimization Addon <= 3.4.18 - Unaut -
CVE-2026-100196
LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site -
CVE-2026-107742
10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site -
CVE-2026-102402
Team <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Si
V. Comments for CVE-2026-94665
No comments yet