What is the CVSS score of CVE-2026-57381?

CVE-2026-57381 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of PropertyHive are affected by CVE-2026-57381?

PropertyHive, a WordPress real-estate plugin, contains an unauthenticated reflected XSS vulnerability (CVE-2026-57381) with no public exploit identified at time of analysis.

How to fix or mitigate CVE-2026-57381?

Within 24 hours: audit all WordPress instances for PropertyHive plugin versions ≤2.2.3 and document affected sites; notify site administrators of the risk and the need to avoid clicking suspicious links. Within 7 days: implement Web Application Firewall (WAF) rules to detect reflected XSS patterns, deploy Content Security Policy (CSP) headers to restrict script execution, and enforce multi-factor authentication on WordPress admin accounts to mitigate credential compromise risk. Within 30 days: since no vendor-released patch has been identified at time of analysis, prioritize deactivating PropertyHive or migrating to actively maintained alternatives with documented security update practices.

PropertyHive CVE-2026-57381

EUVD-2026-43455 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Propertyhive Wordpress Plugin

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network reflected XSS requiring victim click (UI:R) with cross-context execution (S:C) and limited browser-side confidentiality/integrity/availability impact, matching the disclosed vector.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:04 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive propertyhive allows Reflected XSS.This issue affects PropertyHive: from n/a through <= 2.2.3.

AnalysisAI

Reflected cross-site scripting in the PropertyHive WordPress real-estate plugin (all versions up to and including 2.2.3) lets a remote attacker inject arbitrary JavaScript that executes in a victim's browser when they click a crafted link. No public exploit has been identified at time of analysis and the flaw is not on CISA KEV; EPSS data was not provided. Because exploitation is unauthenticated (PR:N) but requires user interaction (UI:R), practical risk depends on luring a logged-in user or administrator to a malicious URL.

Technical ContextAI

PropertyHive is a WordPress plugin that adds estate-agency/property-listing functionality to WordPress sites (CPE cpe:2.3:a:property_hive:propertyhive:*:*:*:*:*:*:*:*). The root cause is CWE-79, Improper Neutralization of Input During Web Page Generation, specifically the reflected variant: user-controlled input (typically a GET/query parameter) is echoed back into an HTML response without proper output encoding or contextual escaping, so the browser interprets attacker-supplied markup as executable script. As a WordPress plugin it runs within the site's PHP request lifecycle and inherits the DOM/session context of whichever WordPress page reflects the tainted parameter.

RemediationAI

No vendor-released patch version was identified in the provided data; the advisory only records affected versions through 2.2.3, so administrators should consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/propertyhive/vulnerability/wordpress-propertyhive-plugin-2-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve) and the WordPress plugin repository for a release later than 2.2.3 and upgrade as soon as one is confirmed. Until a fixed release is verified, apply compensating controls: deploy a Web Application Firewall or virtual patch (Patchstack and similar WordPress WAFs offer rules for this CVE) to filter XSS payloads in request parameters, and add a restrictive Content-Security-Policy header to constrain inline script execution - noting CSP may break legitimate inline scripts/themes and needs testing. If PropertyHive is not essential, deactivating the plugin removes exposure entirely at the cost of lost property-listing functionality.