CVE-2026-61989
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Easy Property Listings WordPress plugin in versions up to 3.5.25 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious script that executes in the user's browser.
Risk Assessment
Attackers could hijack user sessions, perform actions on their behalf, or redirect them to malicious sites. The risk affects all visitors of a site running the vulnerable plugin.
Recommendation
Update the Easy Property Listings plugin to a version newer than 3.5.25. Until then, consider disabling the plugin or deploying WAF rules that filter XSS attempts.
Other vulnerabilities in Easy Property Listings
See all- CVE-2026-16684Medium
The Easy Property Listings plugin for WordPress up to version 3.5.24 contains a Stored Cross-Site Scripting (XSS) vulnerability via the 'facebook' user contact method. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts that execute whenever a user accesses an injected page.
- CVE-2025-64242Medium
The Easy Property Listings plugin by Merv Barrett contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 3.5.22.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS