The vulnerability arises from improper neutralization of user‑supplied input when generating web pages, allowing an attacker to store malicious script code that is later executed in the browsers of users who view the affected content. This stored cross‑site scripting can lead to session hijacking, cookie theft, data manipulation, and defacement of the site, undermining the confidentiality, integrity, and availability of the application for all visitors.

WordPress sites that use the PropertyHive plugin up to version 2.1.5, any installation of the Property Hive PropertyHive plugin. The affected range is from the earliest release through 2.1.5 inclusive.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of mass exploitation at this time. The vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector is a stored XSS scenario in which the attacker must create or modify content that is then rendered by the plugin; thus, users with content‑creation privileges can inject the exploit, potentially affecting all visitors to the site.