What is the CVSS score of CVE-2026-57381?

CVE-2026-57381 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of PropertyHive are affected by CVE-2026-57381?

PropertyHive, a WordPress real-estate plugin, contains an unauthenticated reflected XSS vulnerability (CVE-2026-57381) with no public exploit identified at time of analysis.

How to fix or mitigate CVE-2026-57381?

Within 24 hours: audit all WordPress instances for PropertyHive plugin versions ≤2.2.3 and document affected sites; notify site administrators of the risk and the need to avoid clicking suspicious links. Within 7 days: implement Web Application Firewall (WAF) rules to detect reflected XSS patterns, deploy Content Security Policy (CSP) headers to restrict script execution, and enforce multi-factor authentication on WordPress admin accounts to mitigate credential compromise risk. Within 30 days: since no vendor-released patch has been identified at time of analysis, prioritize deactivating PropertyHive or migrating to actively maintained alternatives with documented security update practices.

PropertyHive CVE-2026-57381

EUVD-2026-43455 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

XSS Propertyhive

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network reflected XSS requiring victim click (UI:R) with cross-context execution (S:C) and limited browser-side confidentiality/integrity/availability impact, matching the disclosed vector.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:04 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive propertyhive allows Reflected XSS.This issue affects PropertyHive: from n/a through <= 2.2.3.

AnalysisAI

Reflected cross-site scripting in the PropertyHive WordPress real-estate plugin (all versions up to and including 2.2.3) lets a remote attacker inject arbitrary JavaScript that executes in a victim's browser when they click a crafted link. No public exploit has been identified at time of analysis and the flaw is not on CISA KEV; EPSS data was not provided. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft malicious URL with XSS payload

Delivery

Deliver link to victim via phishing

Exploit

Victim's browser loads reflected parameter

Execution

Injected JavaScript executes in site context

Impact

Steal session or act as victim