CVE-2026-65560 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting Houzez Property Feed versions up to 2.5.48. This vulnerability allows remote attackers to inject malicious scripts that can execute in the context of the victim's browser, potentially leading to partial confidentiality, integrity, and availability impacts. The vulnerability requires no privileges and has low attack complexity, but user interaction is required. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L.

Successful exploitation can lead to partial disclosure of information, modification of data, and disruption of service due to the XSS vulnerability. Since the vulnerability is unauthenticated and remotely exploitable, it poses a significant risk to users interacting with the affected application. The scope is changed, indicating that the vulnerability affects components beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted inputs in the affected application and consider implementing web application firewalls or input sanitization as temporary mitigations.