THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-16684 (MEDIUM 6.4) — The Easy Property Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'facebook' User Contact Method in all versions up to, and including, 3.5.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attack

[NVD] CVE-2026-16684 (MEDIUM 6.4) — The Easy Property Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'facebook' User Contact Method in all versions up to, and including, 3.5.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attack

mednvdPublished 2026-08-01

CVE-2026-16684 CVSS: 6.4 MEDIUM Published: 2026-08-01T09:17:01.117

The Easy Property Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'facebook' User Contact Method in all versions up to, and including, 3.5.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inje

Indicators of compromise

CVE-2026-16684cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-16684