CVE-2026-61989: Unauthenticated XSS in Easy Property Listings ≤ 3.5.25

CVE-2026-61989 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting Easy Property Listings WordPress plugin in all versions up to and including 3.5.25. An unauthenticated attacker can inject malicious JavaScript code that executes in the browser context of victims. Websites using this plugin that have not applied security patches remain exposed to this attack vector.

The CVSS score is 7.1, in the HIGH severity band: while not as critical as RCE, it requires immediate attention. The vulnerability was officially published on NVD on 2026-10-29. The public availability of a Proof of Concept (PoC) on GitHub as of 2026-11-07 significantly amplifies the risk of active exploitation in the coming days.

System administrators and IT teams must urgently verify with the official developer whether a patch is already available. If the patch has been released, updating the plugin is an immediate priority. In the meantime, monitor access logs and WAF (Web Application Firewall) alerts for indicators of exploitation attempts, such as requests containing scripts or anomalous special characters.

If immediate update is not possible due to compatibility or testing constraints, implement WAF rules to block typical XSS patterns. Verify that the plugin's exposed functions are not accessible to anonymous visitors, where possible restricting access to authenticated back-end context. Temporarily disable the plugin if it is not essential for operations.

Maintain active file integrity checks for the plugin and plan a priority update as soon as a patch is available. Document the vulnerability status in your security ticketing system to ensure traceability of incident handling. Communicate the risk to relevant stakeholders, especially if the plugin handles sensitive real estate data.