The vulnerability is an improper neutralization of input during web page generation in the PropertyHive WordPress plugin. It results in a stored cross‑site scripting flaw that allows an attacker to place malicious JavaScript code that will be run when the affected content is displayed. This client‑side code can compromise user sessions, exfiltrate data, or alter visible page content.

WordPress sites that use the PropertyHive plugin version 2.1.2 or earlier. The attack vector requires that the vulnerable plugin be present and that a user with sufficient privileges can submit or modify data stored by the plugin.

The CVSS score of 6.5 indicates a medium severity, while the EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to submit malicious payloads through the plugin’s data entry forms, which are then stored and later rendered to visitors. The attack therefore relies on web‑based, client‑side execution and does not require direct server‑side compromise.