SZB-9b93ed9ac5
EUVD lists unauthenticated XSS in Easy Property Listings
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Merv Barrett
- Product
- Easy Property Listings
- First seen
Summary
The EU Vulnerability Database (EUVD) entry EUVD-2026-112957, relayed in a Mastodon post, describes an unauthenticated cross-site scripting flaw in Easy Property Listings versions 3.5.25 and earlier. The entry gives a CVSS v3.1 score of 7.1 and was published 2026-10-29 and updated 2026-10-30.
If you use Merv Barrett
Update Easy Property Listings to a version later than 3.5.25.
Check the plugin developer's listing for the fixed version.
Review listing pages for signs of injected scripts.
What the sources say 1
· Mastodon: “Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions.” Source