PT-2026-67121 · WordPress · Easy Property Listings
CVSS v3.1
6.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Easy Property Listings versions prior to 3.5.25
Description
Insufficient input sanitization and output escaping in the 'facebook' User Contact Method allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This enables the injection of arbitrary web scripts into pages, which execute when a user accesses the affected page.
Recommendations
Update Easy Property Listings to version 3.5.25 or later.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Easy Property Listings