CVE-2026-57381

HighCVSS 7.1

Published: 13/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

The PropertyHive WordPress plugin contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects all versions up to and including 2.2.3.

Risk Assessment

An attacker can inject malicious JavaScript code into the page, potentially leading to session hijacking, redirection to malicious sites, or theft of sensitive data.

Recommendation

Immediately update the PropertyHive plugin to the latest available version that fixes this vulnerability. Until updated, restrict access to the WordPress admin panel.

Other vulnerabilities in PropertyHive

CVE-2026-66578Medium
The PropertyHive plugin in versions up to and including 2.2.6 contains a Cross Site Scripting (XSS) vulnerability. A user with Contributor privileges can inject malicious script code.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive propertyhive allows Reflected XSS.This issue affects PropertyHive: from n/a through <= 2.2.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS