CVE-2026-16684 Overview
CVE-2026-16684 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Easy Property Listings plugin for WordPress in all versions up to and including 3.5.24. The flaw resides in the handling of the facebook User Contact Method, where the plugin fails to properly sanitize input and escape output. Authenticated attackers holding subscriber-level access or higher can inject arbitrary JavaScript into pages rendered by the plugin. The injected script executes in the browser of any visitor who accesses an affected page, enabling session theft, redirection, or actions performed on behalf of the victim. The issue is categorized under CWE-79.
Critical Impact
Authenticated subscribers can persist malicious JavaScript that executes against site visitors and administrators, enabling account takeover and content manipulation.
Affected Products
- Easy Property Listings WordPress plugin, all versions up to and including 3.5.24
- WordPress sites that expose author or agent profile pages via the plugin
- Deployments allowing subscriber-level user registration
Discovery Timeline
- 2026-08-01 - CVE-2026-16684 published to the National Vulnerability Database
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-16684
Vulnerability Analysis
The vulnerability exists in the Easy Property Listings plugin's handling of user contact fields, specifically the facebook field added through WordPress's User Contact Method API. The plugin stores the attacker-supplied value and later renders it into HTML output on author or agent listing pages. Because the plugin does not apply sufficient sanitization when the value is stored, nor proper escaping when the value is output, attacker-controlled markup reaches the DOM intact. Any authenticated user with subscriber privileges can update this field via the standard WordPress profile interface. Once the payload is stored, it triggers whenever visitors load the associated author or agent page, giving the attack broad reach across the site.
Root Cause
The root cause is a missing output-escaping step in the plugin's author rendering logic. References to the affected code paths appear in class-epl-author.php line 198, class-epl-author.php line 680, and user.php line 31. Values retrieved from the facebook user meta field are concatenated into HTML without passing through esc_url, esc_attr, or esc_html. This omission allows raw <script> tags or event-handler attributes to survive rendering.
Attack Vector
An attacker registers or uses an existing subscriber-level account, edits the profile, and stores a JavaScript payload in the facebook contact field. When any visitor loads a page that renders that user's profile through the plugin, the payload executes in the visitor's browser session. Because the scope is Changed in the CVSS vector, the impact can extend beyond the vulnerable component to affect authenticated administrators viewing the same content. See the Wordfence Vulnerability Report for additional detail.
No verified public proof-of-concept code is available at the time of publication. Technical details are described in the linked plugin source references and vendor changeset above.
Detection Methods for CVE-2026-16684
Indicators of Compromise
- User meta records where the facebook field contains <script>, javascript:, onerror=, or other HTML/JavaScript control characters
- Subscriber accounts created shortly before profile updates that modify contact method fields
- Outbound network requests from visitor browsers to unfamiliar domains when loading author or agent pages
- Unexpected administrative actions originating from admin sessions after viewing author profiles
Detection Strategies
- Query the wp_usermeta table for meta_key = 'facebook' values containing angle brackets, javascript:, or event-handler substrings
- Review WordPress audit logs for profile updates by subscriber-level accounts targeting contact method fields
- Inspect rendered author and agent pages for unescaped script content using automated crawlers
Monitoring Recommendations
- Alert on new subscriber registrations followed by profile edits within short time windows
- Monitor web server logs for POST requests to /wp-admin/profile.php and /wp-admin/user-edit.php from low-privilege accounts
- Track Content Security Policy (CSP) violation reports for inline script execution on author archive pages
How to Mitigate CVE-2026-16684
Immediate Actions Required
- Update the Easy Property Listings plugin to a version above 3.5.24 as soon as a patched release is available
- Audit all existing user profiles for malicious content in the facebook and other contact method fields
- Restrict new user registration to trusted roles, or disable open subscriber registration where not required
- Review WordPress administrator activity for signs of session hijacking or unauthorized configuration changes
Patch Information
The vendor committed a fix tracked in the Easy Property Listings changeset 3627878. Site administrators should install the fixed release from the WordPress plugin repository. Verify the installed version through the WordPress admin plugins page after update.
Workarounds
- Temporarily disable the Easy Property Listings plugin until a patched version is applied
- Remove or reset the facebook field for all non-administrator accounts through a database query
- Deploy a Web Application Firewall (WAF) rule to block requests containing script tags or JavaScript URIs in the facebook profile field
- Implement a strict Content Security Policy that disallows inline scripts on public-facing pages
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
