CVE-2025-39577: 
WordPress vulnerability analysis and mitigation

CVE-2025-39577 is a Cross-Site Scripting (XSS) vulnerability discovered in PropertyHive WordPress plugin versions through 2.1.2. The vulnerability was disclosed on April 16, 2025, and allows for Stored XSS attacks. This security issue affects the PropertyHive plugin's web page generation functionality due to improper neutralization of input (NVD).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation vulnerability (CWE-79). It has been assigned a CVSS v3.1 Base Score of 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vulnerability requires a low level of access privileges and user interaction for successful exploitation (Patchstack).

If exploited, this vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when visitors access the affected site (Patchstack).

The vulnerability has been patched in PropertyHive version 2.1.3. Users are advised to update to this version or later to remove the vulnerability. The security issue is considered to have a low severity impact and is unlikely to be exploited (Patchstack).