Easy Property Listings: Unauthenticated Cross-Site Scripting (CVE-2026-61989)
An unauthenticated Cross-Site Scripting (XSS) vulnerability in Easy Property Listings versions 3.5.25 and earlier allows attackers to inject malicious scripts into web pages viewed by other users.
CVE search metadata
CVE search record: CVE-2026-61989. Severity: high. CVSS: 7.1. KEV: no. Product: Easy Property Listings (<= 3.5.25). Brief: Easy Property Listings: Unauthenticated Cross-Site Scripting (CVE-2026-61989). Brief link: https://feed.craftedsignal.io/briefs/2026-10-easy-property-listings-xss/
Triage facts
Revision 1- Applicability
- Easy Property Listings (<= 3.5.25)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 29, 17:40 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
CVE-2026-61989 describes an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting Easy Property Listings versions 3.5.25 and earlier. The vulnerability allows an attacker to inject arbitrary client-side scripts into web pages, which are then executed within the context of other users' sessions. This can lead to unauthorized actions performed on behalf of the victim or session hijacking.
Impact
Successful exploitation allows for the execution of unauthorized scripts in the context of a victim's session, potentially leading to unauthorized actions or session hijacking.
Recommendation
Update the Easy Property Listings plugin to a version released after 3.5.25 to remediate this vulnerability. Implement a Web Application Firewall (WAF) to filter malicious input patterns associated with XSS attacks for the affected web application.
Threat Hunt
Hunt for web request logs containing suspicious script-like payloads in parameters
Data: Web server access logs
Mitigations
Upgrade Easy Property Listings to a version beyond 3.5.25
CVE-2026-61989