CVE-2026-65560

HighCVSS 7.1

Published: 06/08/2026(UTC)Updated: 24/10/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed versions up to 2.5.48.

Risk Assessment

An attacker can inject malicious script that executes in the admin's browser, potentially leading to session theft or admin panel takeover.

Recommendation

Update the Houzez Property Feed plugin to the latest available version that includes the fix.

Other vulnerabilities in Houzez Property Feed

CVE-2026-13357Medium
The Houzez Property Feed plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to and including 2.5.46. This is due to insufficient escaping and lack of proper SQL query preparation in the prepare_items() method of the Houzez_Property_Feed_Admin_Logs_Export_Table and Houzez_Property_Feed_Admin_Logs_Import_Table classes.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS