Easy Property Listings vulnerabilities

The Easy Property Listings WordPress plugin in versions up to 3.5.25 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious script that executes in the user's browser.

The Easy Property Listings plugin for WordPress up to version 3.5.24 contains a Stored Cross-Site Scripting (XSS) vulnerability via the 'facebook' user contact method. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts that execute whenever a user accesses an injected page.

The Easy Property Listings plugin by Merv Barrett contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 3.5.22.