CVE-2026-65560: WordPress Houzez Property Feed plugin <= 2.5.48 - Cross Site Scripting (XSS) vulnerability

Published Aug 6, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions.

Affected Software

1 affected component

Houzez Property Feed<=2.5.48

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Houzez Property Feed plugin to a version that resolves this vulnerability.
Fixed in 2.5.49

Aug 6, 2026

CVE Published

via MITRE·02:27 PM

Data Sourced

via MITRE·02:27 PM

RemedyDescriptionSeverityWeakness

The severity of CVE-2026-65560 is high, with a rating of 7.1.

To fix CVE-2026-65560, update the Houzez Property Feed plugin to a version greater than 2.5.48.

CVE-2026-65560 is an Unauthenticated Cross Site Scripting (XSS) vulnerability.

Users of the Houzez Property Feed plugin version 2.5.48 and lower are affected by CVE-2026-65560.

CVE-2026-65560 could allow an attacker to execute malicious scripts in the context of a user's browser.