CVE-2026-42729

Vulnerability

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the PropertyHive plugin for WordPress, affecting versions from n/a through 2.2.2. The plugin fails to properly neutralize user input during web page generation, allowing attackers to inject arbitrary JavaScript that executes in the victim's browser context [1].

Exploitation

To exploit this vulnerability, an attacker must trick a privileged user (e.g., an administrator) into performing an action such as clicking a malicious link, visiting a crafted page, or submitting a form. No prior authentication is required, but successful exploitation depends on user interaction [1].

Impact

Successful exploitation allows an attacker to inject malicious scripts, including redirects, advertisements, and other HTML payloads, which execute when visitors access the affected site. This could lead to information disclosure, session hijacking, or defacement [1].

Mitigation

The vulnerability is fixed in version 2.2.3 of the PropertyHive plugin. Users should update immediately. For those unable to update, Patchstack provides a mitigation rule to block attacks until the patch is applied [1].