127 matches found
EUVD-2026-112957
Unauthenticated Cross Site Scripting XSS in Easy Property Listings = 3.5.25 versions...
CVE-2026-61989
The WordPress Easy Property Listings plugin (versions
CVE-2026-96902
The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact ma...
CVE-2026-96903
The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private...
CVE-2026-96903
The Easy Property Listings WordPress plugin, in versions before 3.5.27 , is vulnerable to a sensitive data disclosure flaw. The plugin fails to perform adequate authorisation checks on several of its contact-management read AJAX actions . This oversight allows any authenticated user, even those w...
WordPress Easy Property Listings plugin < 3.5.27 - Subscriber+ Sensitive Data Disclosure vulnerability
Subscriber+ Sensitive Data Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin Easy Property Listings versions 3.5.27...
EUVD-2026-104801
The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private...
CVE-2026-96903 Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers
The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private...
CVE-2026-96903 Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers
The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private...
CVE-2026-96902 Easy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure via REST API
The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact ma...
CVE-2026-96902 Easy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure via REST API
The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact ma...
EUVD-2026-104800
The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact ma...
CVE-2026-96902
The Easy Property Listings WordPress plugin (versions before 3.5.28 ) contains a vulnerability where it fails to restrict which listing fields are included in the public REST API output. This oversight allows unauthenticated users to access sensitive details that a site administrator intended to ...
WordPress Easy Property Listings plugin < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure vulnerability
Unauthenticated Hidden Listing Details Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin Easy Property Listings versions 3.5.28...
PT-2026-118245
The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private...
PT-2026-118244
The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact ma...
WordPress Easy Property Listings plugin <= 3.5.25 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Mor Golan in WordPress Plugin Easy Property Listings versions = 3.5.25...
WordPress Easy Property Listings plugin <= 3.5.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Easy Property Listings versions = 3.5.24...
CVE-2026-16684
The Easy Property Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'facebook' User Contact Method in all versions up to, and including, 3.5.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-16684
The Easy Property Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'facebook' User Contact Method in all versions up to, and including, 3.5.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...