{"id":"CVE-2026-61989","kind":"vulnerability","aliases":["CVE-2026-61989"],"related":[],"title":"Easy Property Listings WordPress plugin: unauthenticated XSS through versions 3.5.25","description":"Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions.","summary":"The Easy Property Listings WordPress plugin, versions up to and including 3.5.25, has a cross-site scripting flaw that needs no login. An attacker can get script to run in a visitor's browser on a site running the plugin.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Easy Property Listings","fixed":["3.5.26"],"affected":"<= 3.5.25","ecosystem":"wordpress"}],"ecosystems":[],"tags":["easy-property-listings","package","wordpress","wordpress-plugin","xss"],"not_affected_if":["plugin-not-installed"],"how_to_check":"In WordPress admin > Plugins, check Easy Property Listings version; 3.5.25 or lower is vulnerable. Or run: wp plugin get easy-property-listings --field=version","fix":"Update Easy Property Listings to 3.5.26 or later (3.5.28 is the latest listed by third parties).","status":"open","published_at":"2026-10-29T16:18:11+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","triaged_at":"2026-10-29T16:29:55+00:00","updated_at":"2026-10-29T16:36:57+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T16:29:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Easy Property Listings WordPress plugin: unauthenticated XSS through versions 3.5.25","impact":"medium","summary":"The Easy Property Listings WordPress plugin, versions up to and including 3.5.25, has a cross-site scripting flaw that needs no login. An attacker can get script to run in a visitor's browser on a site running the plugin.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","easy-property-listings"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in visitors' browsers on the site","analyst_note":"Find the vendor advisory or the NVD entry details to identify the vulnerable input, and confirm the first fixed version and whether one exists.","how_to_check":"- Check the installed Easy Property Listings plugin version in the WordPress admin under Plugins.\n- Treat any installed version at or below `3.5.25` as exposed.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Easy Property Listings WordPress plugin at version 3.5.25 or earlier are exposed. The sources do not say which pages or inputs trigger the flaw, so the exact data path is unknown. Sites without the plugin installed are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000668,"input_tokens":4070,"output_tokens":522,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory or the NVD entry details to identify the vulnerable input, and confirm the first fixed version and whether one exists.","search":"'-2026':12A,15A '-61989':13A,16A '3.5.25':10A,41B,80C 'attack':54B 'browser':64B 'cross':45B,72C 'cross-sit':44B 'cve':11A,14A 'easi':1A,21B,31B,77C 'easy':17A 'easy-property-list':20B 'flaw':48B 'get':56B 'includ':40B 'list':3A,23B,33B,79C 'listings':19A 'login':52B 'need':50B 'packag':24B 'plugin':5A,28B,35B,70B 'properti':2A,22B,32B,78C 'property':18A 'run':59B,68B 'script':47B,57B,74C 'site':46B,67B,73C 'unauthent':6A,71C 'version':9A,36B,81C 'visitor':62B 'wordpress':4A,25B,27B,34B 'wordpress-plugin':26B 'xss':7A,29B,75C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the Easy Property Listings plugin at 3.5.25 or earlier. The vendor says the flaw is reachable without login through the epl_action request parameter and the search widget select field (data-min/data-max attributes); third-party trackers (Wordfence/WPScan) describe it as stored XSS, the vendor calls it reflected. Sites without the plugin can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-29T16:36:57Z","by":"analyst","doc":"https://patchstack.com/database/wordpress/plugin/easy-property-listings/vulnerability/wordpress-easy-property-listings-plugin-3-5-25-cross-site-scripting-xss-vulnerability","run_id":1072},"how_to_check":{"at":"2026-10-29T16:36:57Z","by":"analyst","doc":"https://patchstack.com/database/wordpress/plugin/easy-property-listings/vulnerability/wordpress-easy-property-listings-plugin-3-5-25-cross-site-scripting-xss-vulnerability","run_id":1072}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61989","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61989","severity":null,"published_at":"2026-10-29T16:18:11+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","fetched_at":"2026-10-29T16:25:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-61989:1072","url":null,"severity":null,"published_at":"2026-10-29T16:36:57+00:00","modified_at":"2026-10-29T16:36:57+00:00","first_seen_at":"2026-10-29T16:36:57+00:00","fetched_at":"2026-10-29T16:36:57+00:00","note":"Vendor changelog confirms 3.5.26 (2026-10-12) fixes unauthenticated XSS via epl_action and search widget; WPScan/Patchstack agree on <=3.5.25 fixed 3.5.26. Vendor says reflected, WPScan says stored: discrepancy noted. No exploitation or PoC found; no X search done."}],"documents":[{"id":17793,"url":"https://easypropertylistings.com.au/change-log/","title":"Easy Property Listings change log (3.5.26)","kind":"vendor","source":"analyst","publisher":null,"text":"= 3.5.26 October 12, 2026 = Fix: Unauthenticated Reflected Cross-Site Scripting via the epl_action request parameter and the search widget select field; data-min and data-max attributes are now escaped on output. Thanks Patchstack. Fix: epl_action and epl-action request parameters now only dispatch an allow-list of actions for logged in users. New: epl_allowed_request_actions filter.","published_at":null,"relation":"fix","confidence":null,"note":null},{"id":17795,"url":"https://wpscan.com/vulnerability/1366bfea-5321-43d9-b46d-b4b41a604dbc/","title":"WPScan: Easy Property Listings < 3.5.26 Unauthenticated Stored XSS","kind":"advisory","source":"analyst","publisher":null,"text":"Vulnerable up to and including 3.5.25 due to insufficient input sanitization and output escaping; unauthenticated attackers can inject scripts. Fixed in 3.5.26. CVSS 7.2.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":17796,"url":"https://patchstack.com/database/wordpress/plugin/easy-property-listings/vulnerability/wordpress-easy-property-listings-plugin-3-5-25-cross-site-scripting-xss-vulnerability","title":"Patchstack: Easy Property Listings <= 3.5.25 XSS","kind":"advisory","source":"analyst","publisher":null,"text":"<= 3.5.25 vulnerable, 3.5.26 patched, CVSS 7.1, user interaction required.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}