CVE-2026-16684 describes a stored cross-site scripting vulnerability (CWE-79) in the Easy Property Listings plugin for WordPress by mervb1. The flaw arises from improper neutralization of input in the 'facebook' User Contact Method, allowing authenticated users with subscriber-level privileges or higher to inject arbitrary web scripts. These scripts execute in the context of any user who accesses the injected page, potentially leading to information disclosure or session hijacking. The vulnerability affects all versions up to and including 3.5.24. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required at the low level.

An attacker with subscriber-level access or higher can inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of user data or session tokens. There is no direct impact on availability. The vulnerability enables cross-site scripting attacks that can compromise user interactions with the site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user permissions where possible and monitor for suspicious activity related to user contact methods. Avoid using or displaying untrusted input in the 'facebook' User Contact Method fields. Follow vendor updates for a security patch or official mitigation.