Easy Property Listings - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/easy-property-listings/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 17:40:05 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgEasy Property Listings: Unauthenticated Cross-Site Scripting (CVE-2026-61989)https://feed.craftedsignal.io/briefs/2026-10-easy-property-listings-xss/Thu, 29 Oct 2026 17:40:05 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-easy-property-listings-xss/An unauthenticated Cross-Site Scripting (XSS) vulnerability in Easy Property Listings versions 3.5.25 and earlier allows attackers to inject malicious scripts into web pages viewed by other users.CVE-2026-61989 describes an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting Easy Property Listings versions 3.5.25 and earlier. The vulnerability allows an attacker to inject arbitrary client-side scripts into web pages, which are then executed within the context of other users' sessions. This can lead to unauthorized actions performed on behalf of the victim or session hijacking.

Impact

Successful exploitation allows for the execution of unauthorized scripts in the context of a victim's session, potentially leading to unauthorized actions or session hijacking.

Recommendation

Update the Easy Property Listings plugin to a version released after 3.5.25 to remediate this vulnerability. Implement a Web Application Firewall (WAF) to filter malicious input patterns associated with XSS attacks for the affected web application.

]]>highadvisoryweb-applicationxssvulnerability