CVE-2026-16684

This stored XSS in Easy Property Listings targets the Facebook contact method field in WordPress user profiles — a metadata injection surface that most security tooling ignores. Unlike stored XSS in post content or comments, which receive systematic sanitization attention, user contact methods in wp_usermeta render through less audited code paths. A subscriber-level user can inject the payload by editing their profile, but execution occurs when administrators view user profiles, when listing pages display agent information, or when author archives render contact fields. The 6.4 CVSS score misrepresents the actual risk. The blast radius here is asymmetric: a payload injected into post content affects that post's readers, but a payload in user metadata executes everywhere that profile data renders — admin dashboards, frontend profiles, listing cards, email templates. One compromised profile becomes a mass-execution vector across every visitor to any display context. The technical failure is specific: `get_user_meta()` returns raw strings without core escaping by design. Most plugin developers assume contact fields are pre-sanitized because WordPress displays them safely in the admin UI, but that safety doesn't extend to frontend rendering. The correct defensive pattern is input sanitization at storage time (`sanitize_text_field()` or `wp_strip_all_tags()`), not output escaping at display — output escaping with functions like `wp_kses_post()` can be bypassed if input already contains valid-looking HTML. Check your site: review any plugin, theme, or custom code that retrieves user contact methods via `get_user_meta()` or `get_userdata()` and renders them on the frontend. Verify whether escaping is applied at the render point, but more importantly, verify whether input sanitization happens when the field is saved. Also audit wp_usermeta for any orphaned Facebook fields from abandoned plugins — poisoned metadata persists after plugin deletion and will execute in any future context that queries that field.

Reviewed through automated stages and approved by a human before publication.