CVE-2026-104722mediumCWE-22

CVE-2026-104722: fallo de gravedad media en webilia Listdom: AI-powered Business Directory…

Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.2 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'ix[file]' Parameter

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Listdom: AI-powered Business Directory with Classifieds Ads Listings

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.9epss 0.7%
The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSD_Menus_IX_CSV::import function in all versions up to, and including, 6.1.2 This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Productos afectados
webilia · Listdom: AI-powered Business Directory with Classifieds Ads Listings
CVEs relacionadas — webilia Listdom: AI-powered Business Directory…

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-19796HIGHListdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.8.1 - Unauthenticated Stored Cross-Site Scripting via 'lsd[displ][style]' ParameterEPSS 0.4%CVE-2024-11854MEDIUMListdom – Business Directory and Classified Ads Listings WordPress Plugin <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode ParameterEPSS 0.3%CVE-2026-96647MEDIUMListdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lsd[remark]' ParameterEPSS 0.2%