What is the CVSS score of CVE-2026-16684?

CVE-2026-16684 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Easy Property Listings CVE-2026-16684

EUVD-2026-51741 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-01 Wordfence

GHSA-h45j-xv2v-ffgq

WordPress XSS Easy Property Listings Wordpress Plugin

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Victim must actively visit the injected page (UI:R per CVSS 3.1 spec); subscriber account required (PR:L); script executes in victim browser context constituting a scope change (S:C).

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 01, 2026 - 08:56 vuln.today

CVE Published

Aug 01, 2026 - 07:49 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Easy Property Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'facebook' User Contact Method in all versions up to, and including, 3.5.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Easy Property Listings WordPress plugin (all versions up to and including 3.5.24) allows any authenticated subscriber-level user to permanently inject malicious JavaScript through the 'facebook' User Contact Method profile field. The injected payload persists in the WordPress database and executes automatically in the browser of any site visitor who views a property listing page rendering the compromised author profile, enabling session hijacking, credential theft, or administrative account takeover. No KEV listing or confirmed public exploit code was identified in the available input data; a fix changeset exists in the WordPress plugin repository but an exact patched release version is not confirmed from the provided data.

Technical ContextAI

The affected component is the Easy Property Listings WordPress plugin (CPE: cpe:2.3:a:mervb1:easy_property_listings:*:*:*:*:*:*:*:*), a real-estate-focused plugin that extends WordPress user profiles with property-agent contact fields. The vulnerability maps to CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS): user-supplied input entered into the 'facebook' contact method field is written to the WordPress database without adequate sanitization and subsequently rendered into page HTML without proper output escaping. The relevant code paths are identifiable in the plugin's Trac repository at class-epl-author.php (lines 198 and 680) and user.php (line 31), where author profile data is retrieved and output, confirming the stored rather than reflected nature of the injection. Because the output renders inside the WordPress page DOM without escaping, any valid HTML or JavaScript submitted in that field becomes executable markup for every visitor whose browser loads the affected listing page.

RemediationAI

A fix changeset was committed to the WordPress plugin Subversion repository (https://plugins.trac.wordpress.org/changeset?reponame=&old=3627878%40easy-property-listings&new=3627878%40easy-property-listings); administrators should update the Easy Property Listings plugin to the latest version available in the WordPress plugin directory and confirm it exceeds 3.5.24. The exact patched release version number is not confirmed from the provided input data - verify the installed version against the WordPress plugin changelog after updating. As an immediate compensating control where patching is not feasible, restrict WordPress user registration to prevent untrusted subscriber account creation, since exploitation requires at minimum subscriber-level access; note that this does not protect against compromise by existing registered users. A Web Application Firewall rule targeting script injection patterns in profile field submissions can reduce exposure but does not address the underlying sanitization defect and may cause false positives on legitimate URLs. Sites using the plugin should also audit existing user profiles for the presence of injected payloads in the facebook contact field.