CVE-2026-57381

WordPress PropertyHive plugin <= 2.2.3 - Cross Site Scripting (XSS) vulnerability

Published Jul 13, 2026 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive propertyhive allows Reflected XSS.This issue affects PropertyHive: from n/a through <= 2.2.3.

Analysis

Technical impact

The vulnerability is a reflected Cross Site Scripting flaw due to improper neutralization of user input in the PropertyHive plugin, allowing an attacker to inject arbitrary JavaScript that is executed in the browser of any user who views a page reflecting the input. No additional exploitation conditions are specified.

Affected Systems

WordPress installations that use the PropertyHive plugin version 2.2.3 or earlier.

Risk and Exploitability

The CVSS score of 7.1 indicates high severity. The EPSS score is less than 1%, suggesting exploitation is currently rare. The vulnerability is not listed in CISA KEV. The likely attack vector is web‑based, requiring an attacker to craft a URL or form submission that the plugin reflects; no elevated privileges are required by the description.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Property Hive

PropertyHive

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.2.3

No data.

Vendor Product Versions

Propertyhive

Version	Status	Scheme	Platform
`[0,2.2.3]`	affected	generic	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the PropertyHive plugin to version 2.2.4 or later to eliminate the XSS flaw.
If an upgrade cannot be performed immediately, implement a strict Content‑Security‑Policy that blocks inline scripts and limits script sources to trusted origins.
Review any exposed input fields or endpoints that allow arbitrary user input to be reflected and remove or sanitize them.

Generated by OpenCVE AI on July 31, 2026 at 12:06 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.251% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/propertyhive/vulnerability/wordpress-propertyhive-plugin-2-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve

History

Jul 13, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 13, 2026 12:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Propertyhive Propertyhive propertyhive Wordpress Wordpress wordpress
Vendors & Products		Propertyhive Propertyhive propertyhive Wordpress Wordpress wordpress

Jul 13, 2026 10:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive propertyhive allows Reflected XSS.This issue affects PropertyHive: from n/a through <= 2.2.3.
Title		WordPress PropertyHive plugin <= 2.2.3 - Cross Site Scripting (XSS) vulnerability
Weaknesses		CWE-79
References		https://patchstack.com/database/Wordpress/Plugin/propertyhive/vulnerability/wordpress-propertyhive-plugin-2-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`