{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/easy-property-listings--3.5.25/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:easy_property_listings:easy_property_listings:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-61989"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Easy Property Listings (\u003c= 3.5.25)"],"_cs_severities":["high"],"_cs_tags":["web-application","xss","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Easy Property Listings"],"content_html":"\u003cp\u003eCVE-2026-61989 describes an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting Easy Property Listings versions 3.5.25 and earlier. The vulnerability allows an attacker to inject arbitrary client-side scripts into web pages, which are then executed within the context of other users' sessions. This can lead to unauthorized actions performed on behalf of the victim or session hijacking.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the execution of unauthorized scripts in the context of a victim's session, potentially leading to unauthorized actions or session hijacking.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate the Easy Property Listings plugin to a version released after 3.5.25 to remediate this vulnerability. Implement a Web Application Firewall (WAF) to filter malicious input patterns associated with XSS attacks for the affected web application.\u003c/p\u003e\n","date_modified":"2026-10-29T17:40:05Z","date_published":"2026-10-29T17:40:05Z","id":"https://feed.craftedsignal.io/briefs/2026-10-easy-property-listings-xss/","summary":"An unauthenticated Cross-Site Scripting (XSS) vulnerability in Easy Property Listings versions 3.5.25 and earlier allows attackers to inject malicious scripts into web pages viewed by other users.","title":"Easy Property Listings: Unauthenticated Cross-Site Scripting (CVE-2026-61989)","url":"https://feed.craftedsignal.io/briefs/2026-10-easy-property-listings-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Easy Property Listings (\u003c= 3.5.25)","version":"https://jsonfeed.org/version/1.1"}