The vulnerability is a DOM‑Based XSS flaw caused by improper neutralization of user input during web page generation. Because the PropertyHive plugin fails to escape content that is incorporated into the DOM, an attacker can inject malicious scripts that execute in the victim’s browser. This flaw permits session hijacking, theft of credentials, or other actions that compromise the confidentiality and integrity of the affected website, potentially affecting all authenticated users.

The flaw exists in Property Hive’s PropertyHive plugin for WordPress versions through 2.2.2. Any installation of the plugin on a WordPress site that has not upgraded beyond 2.2.2 is affected. The issue was identified as affecting all releases from unknown earliest to 2.2.2.

The CVSS score of 7.1 classifies the issue as high severity. EPSS is not available, so the likelihood of exploitation is uncertain, but the lack of a KEV listing suggests no current widespread exploitation. The attack surface is the web interface, where an attacker can craft input to a vulnerable field or URL parameter that ends up unescaped in the DOM. If successful, the attacker can execute arbitrary JavaScript in the context of the logged‑in user.