CVE-2026-42658: WordPress Classified Listing plugin <= 5.3.8 - Cross Site Scripting (XSS) vulnerability

Synopsis

Reflected or stored cross-site scripting (XSS) vulnerability affects the Classified Listing WordPress plugin at version 5.3.8 and earlier. The vulnerability is reachable over the network, requires no authentication, and is triggered when a victim visits or interacts with a crafted URL or page. Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser, enabling session hijacking, credential theft, or unauthorized actions performed on the victim's behalf. No fix version has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the vulnerable WordPress installation over the network; no local or physical access is required.

• AuthenticationNot required

  No account or credentials are needed; the vulnerability is exploitable by any unauthenticated party.

• Victim interactionRequired

  A victim must interact with a malicious link or page (for example, clicking a crafted URL delivered via phishing or embedded content) to trigger the JavaScript payload in their browser.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other unpredictable environmental factors.

Blast Radius

• An attacker executes arbitrary JavaScript in the victim's browser session, allowing theft of session cookies or authentication tokens for the affected WordPress site.
• Captured credentials or tokens enable the attacker to impersonate the victim and perform actions on the site with the victim's privilege level.
• Malicious scripts can modify page content visible to the victim, facilitating phishing, fake login forms, or redirection to attacker-controlled infrastructure.
• Depending on the victim's role, exploitation may expose stored personal data or classified listing content rendered on the page at the time of attack.