The Classified Listing plugin exposes an unauthenticated Cross Site Scripting weakness in versions 6.1.3 and earlier because it fails to properly sanitize content before rendering it to users. This flaw allows an attacker to inject arbitrary JavaScript that executes in the context of any visitor who loads a page that renders the plugin’s data, potentially enabling session hijacking, phishing, or site defacement. The weakness is identified as CWE‑79.

Any WordPress installation that has the RadiusTheme Classified Listing plugin version 6.1.3 or older is affected. Site owners with those versions on any production or staging environment should consider themselves at risk until the plugin can be upgraded.

The CVSS score of 7.1 signals a substantial risk level. While the EPSS score is not available, the likely attack vector is the delivery of a malicious payload to any publicly accessible page that includes the plugin, requiring no attacker credentials. The flaw is not currently catalogued in the CISA KEV list, but its impact on user data and trust makes it a notable threat for WordPress sites relying on the plugin.