Stored Cross-Site Scripting Vulnerability in Easy Property Listings Plugin for WordPress

CVE-2026-16684

What is CVE-2026-16684?

The Easy Property Listings plugin for WordPress has a Stored Cross-Site Scripting issue that allows authenticated users with subscriber-level access or higher to execute arbitrary web scripts. This vulnerability arises from inadequate input sanitization and output escaping in the 'facebook' User Contact Method, compromising the integrity of the affected pages. Attackers may inject harmful scripts into these pages, triggering them when other users access the affected content, potentially leading to unauthorized actions and data exposure.

References