CVE-2026-16684 mervb1 CVE debrief

Who should care

Administrators of WordPress sites using the Easy Property Listings plugin, security teams monitoring for vulnerabilities in WordPress plugins, and users with subscriber-level access and above in affected versions.

Technical summary

The Easy Property Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'facebook' User Contact Method. This vulnerability exists in all versions up to, and including, 3.5.24 due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts, which will execute when a user accesses an injected page. The CVSS score for this vulnerability is 6.4, indicating a medium severity.

Defensive priority

Medium priority due to the CVSS score of 6.4 and the potential for authenticated attackers to inject scripts.

Recommended defensive actions

• Update the Easy Property Listings plugin to a version beyond 3.5.24.
• Restrict access to the 'facebook' User Contact Method to prevent unauthorized modifications.
• Implement additional monitoring for suspicious activity related to user contact methods.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

Evidence from the NVD and Wordfence indicates a Stored Cross-Site Scripting vulnerability in the Easy Property Listings plugin for WordPress. The vulnerability exists in versions up to and including 3.5.24 and is caused by insufficient input sanitization and output escaping.

Official resources