CVE-2026-66578

The PropertyHive plugin in versions up to and including 2.2.6 contains a Cross Site Scripting (XSS) vulnerability. A user with Contributor privileges can inject malicious script code.

The malicious script may execute in the browsers of visitors or administrators, risking session data theft and account takeover. This can ultimately compromise the entire site.

Update the PropertyHive plugin to a version newer than 2.2.6. Also consider reviewing Contributor accounts and restricting their privileges.