What is the CVSS score of CVE-2026-65560?

CVE-2026-65560 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Houzez Property Feed are affected by CVE-2026-65560?

The Houzez Property Feed WordPress plugin (v2.5.48 and earlier) contains an unauthenticated cross-site scripting (XSS) vulnerability allowing attackers to inject malicious scripts into pages viewed…

How to fix or mitigate CVE-2026-65560?

Within 24 hours: Immediately disable or remove the Houzez Property Feed plugin from all affected installations and audit access logs for suspicious activity patterns. Within 7 days: If the plugin is mission-critical, implement Web Application Firewall (WAF) rules to block common XSS payloads, enforce Content Security Policy (CSP) headers with 'script-src self' to restrict script execution, and apply input validation and output encoding at the application layer. Within 30 days: Monitor the Houzez plugin repository for a patched version (test in staging before deployment), and concurrently evaluate alternative property feed plugins with active security maintenance as a longer-term replacement to reduce future vulnerability exposure.

Houzez Property Feed CVE-2026-65560

EUVD-2026-53985 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-rf5c-q935-9wph

WordPress XSS Houzez Property Feed Wordpress Plugin

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

XSS yields no meaningful availability impact; C:L and I:L reflect session theft and DOM manipulation; all other metrics align with the provided vector.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:51 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions.

AnalysisAI

Unauthenticated stored or reflected Cross-Site Scripting in the Houzez Property Feed WordPress plugin (versions <= 2.5.48) allows remote unauthenticated attackers to inject arbitrary JavaScript into pages served to victims. The CVSS scope change (S:C) confirms the malicious script executes in the victim's browser context beyond the plugin's own trust boundary, enabling session hijacking, credential theft, or administrative account takeover if a privileged user is targeted. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize user-controlled input before rendering it as HTML or JavaScript in a browser. The affected product, identified by CPE cpe:2.3:a:property_hive:houzez_property_feed:*:*:*:*:*:*:*:* and attributed to the property_hive vendor, is a WordPress plugin that integrates real estate property data feeds with the Houzez theme. The plugin likely processes external feed parameters or URL inputs without adequate output encoding, allowing script injection. The CVSS Scope:Changed metric confirms the injected script escapes the plugin's context and executes with the privileges of the victim's browser session, which is the defining characteristic of cross-site scripting exploited against authenticated users.

RemediationAI

Update the Houzez Property Feed plugin to the version released after 2.5.48 via the WordPress plugin dashboard or by downloading from the official plugin repository. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/houzez-property-feed/vulnerability/wordpress-houzez-property-feed-plugin-2-5-48-cross-site-scripting-xss-vulnerability?_s_id=cve should be consulted for the confirmed fixed version, which is not independently specified in the available input data. As a compensating control where immediate patching is not possible, deploy a Web Application Firewall (WAF) rule blocking common XSS payloads in input parameters handled by the plugin - noting that WAF bypasses exist and this is not a substitute for patching. Additionally, restrict access to the WordPress admin panel to known IP ranges to limit the impact of successful XSS attacks targeting administrators.