Live › vulnerability › CVE-2026-61989
The Easy Property Listings WordPress plugin, versions up to and including 3.5.25, has a cross-site scripting flaw that needs no login. An attacker can get script to run in a visitor's browser on a site running the plugin.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
WordPress sites running the Easy Property Listings plugin at 3.5.25 or earlier. The vendor says the flaw is reachable without login through the epl_action request parameter and the search widget select field (data-min/data-max attributes); third-party trackers (Wordfence/WPScan) describe it as stored XSS, the vendor calls it reflected. Sites without the plugin can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Easy Property Listings | wordpress | <= 3.5.25 | 3.5.26 |
3.5.25 or lower is vulnerableUpdate Easy Property Listings to 3.5.26 or later (3.5.28 is the latest listed by third parties).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-61989")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.