Unknown Classified Listing vulnerabilities

5 CVEs affecting Unknown Classified Listing, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-106646, published 2026-10-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-16276, published 2026-08-03. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access…
CVE-2026-16274, published 2026-08-03. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access…
CVE-2026-14183, published 2026-07-21. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with…
CVE-2026-106646, published 2026-10-14. Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days. The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any…
CVE-2026-16281, published 2026-09-04. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing…