CVE-2026-16684 is a stored cross-site scripting vulnerability in the Easy Property Listings plugin for WordPress, affecting all versions up to and including 3.5.24. The flaw exists because the plugin does not properly sanitize or escape input in the 'facebook' User Contact Method field, allowing authenticated users with subscriber-level privileges or above to inject arbitrary web scripts. These scripts execute in the context of other users viewing the injected pages, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 6.4, indicating a medium severity vulnerability with network attack vector, low attack complexity, and requiring privileges but no user interaction.

An attacker with subscriber-level access or higher can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who view the compromised pages. This can lead to limited confidentiality and integrity impacts, such as theft of session tokens or modification of displayed content. There is no direct impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level user permissions and monitor for suspicious activity related to the 'facebook' User Contact Method input. Avoid granting unnecessary privileges to untrusted users.