The vulnerability allows an authenticated user with Subscriber-level access to inject and execute arbitrary shortcodes within listing descriptions. By supplying a crafted shortcode, the user triggers WordPress’s do_shortcode function without validating the content, which can lead to execution of server‑side code and compromise the website’s confidentiality, integrity, and availability.

All installations of the Classified Listing – AI‑Powered Classified ads & Business Directory Plugin, version 5.0.3 or earlier, distributed by techlabpro1.

The CVSS base score of 5.4 indicates a medium severity. The EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. A likely attack vector requires the attacker to have a legitimate WordPress account with Subscriber or higher privileges; once authenticated, the attacker can submit a listing containing a malicious shortcode that bypasses validation and is processed by do_shortcode, giving the attacker the ability to run arbitrary PHP code on the server.