The vulnerability is a stored cross‑site scripting flaw that allows an attacker to inject arbitrary HTML or JavaScript into the Classified Listing plugin on vulnerable WordPress sites. Because the plugin does not properly neutralize user‑supplied input during page rendering, malicious scripts can run in the browsers of any visitor who views the affected page, enabling defacement, credential theft, or session hijacking.

WordPress Classified Listing plugin, versions 6.1.2 and earlier, from the initial release through the 6.1.2 release. The vulnerability affects all installations of this plugin that have not been upgraded to 6.1.3 or later.

The vulnerability has a CVSS score of 6.5, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the plugin’s web interface, where users (or attackers with permissions to submit listings) can supply unsanitized input that is stored and later rendered within page content. If exploited, an attacker can deliver malicious code that executes in the context of any visitor to the affected listing pages.