The Classified Listing plugin for WordPress does not properly validate the quantity input supplied by users, allowing attackers to inject static code that can be executed by the server. This flaw also permits access to plugin functionality that is not properly constrained by access control lists, thereby increasing the risk of privilege escalation and compromising the integrity of the website. The vulnerability aligns with CWE-1284, indicating an improper validation of quantity values, and presents a moderate risk as indicated by the CVSS base score of 4.3.

Any WordPress installation running the Classified Listing plugin version 6.1.5 or earlier, developed by Mamunur Rashid, is affected. No specific WordPress core version constraints are noted; the issue applies broadly to environments with the vulnerable plugin installed.

The CVSS score of 4.3 denotes moderate severity, and the absence of an exploited instance in the KEV catalog or documented public exploits suggests a relatively low immediate exploitation likelihood. The attack vector is inferred to be remote through crafted HTTP requests targeting the quantity field on the plugin's forms. An attacker would need to supply a payload that bypasses the inadequate input checks; if successful, the server could execute arbitrary code. Because the plugin permits unauthenticated or low‑privileged users to hit the vulnerable functionality, the risk of broader site compromise remains a concern.