Skip to content
Noroxi

Property Hive

propertyhive · plugin

Known security vulnerabilities for Property Hive. Find out in seconds which version runs on your site with WP Lens.

19 known vulnerabilities

1 critical · 10 exploitable without logging in · latest Sep 17, 2026

Listed on wordpress.org · latest 2.4.0 · last updated Sep 23, 2026 · 3K+ installs

wordpress.org status checked on Oct 4, 2026

Vulnerabilities

  • CVE-2024-23513unauthenticated≤ 2.0.5

    WordPress PropertyHive Plugin <= 2.0.5 is vulnerable to PHP Object Injection

    Critical 9.8

  • CVE-2024-27985unauthenticated≤ 2.0.9

    WordPress PropertyHive plugin <= 2.0.9 - PHP Object Injection vulnerability

    High 8.8

  • CVE-2025-66088unauthenticated≤ 2.1.12

    WordPress PropertyHive plugin <= 2.1.12 - Broken Access Control vulnerability

    High 7.5

  • CVE-2026-57381unauthenticated · needs a click≤ 2.2.3

    WordPress PropertyHive plugin <= 2.2.3 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2026-42729unauthenticated · needs a click≤ 2.2.2

    WordPress PropertyHive plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2024-8490unauthenticated · needs a click≤ 2.0.19

    PropertyHive <= 2.0.19 - Cross-Site Request Forgery via save_account_details

    Medium 6.5

  • CVE-2025-58612login required≤ 2.1.5

    WordPress PropertyHive Plugin <= 2.1.5 - Cross Site Scripting (XSS) Vulnerability

    Medium 6.5

  • CVE-2025-39577login required≤ 2.1.2

    WordPress PropertyHive plugin <= 2.1.2 - Cross Site Scripting (XSS) Vulnerability

    Medium 6.5

  • CVE-2024-24718login required≤ 2.0.6

    WordPress PropertyHive plugin <= 2.0.6 - Missing Authorization to Non-Arbitrary Plugin Installation vulnerability

    Medium 6.5

  • CVE-2026-66578contributor+≤ 2.2.6

    WordPress PropertyHive plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2024-29923unauthenticated · needs a click≤ 2.0.8

    WordPress PropertyHive plugin <= 2.0.8 - Reflected Cross Site Scripting (XSS) vulnerability

    Medium 6.1

  • CVE-2023-22706unauthenticated · needs a click≤ 1.5.48

    WordPress PropertyHive Plugin <= 1.5.48 is vulnerable to Cross Site Scripting (XSS)

    Medium 6.1

  • CVE-2023-29172unauthenticated · needs a click≤ 1.5.46

    WordPress PropertyHive Plugin <= 1.5.46 is vulnerable to Cross Site Scripting (XSS)

    Medium 6.1

  • CVE-2018-6465unauthenticated · needs a click

    The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-em

    Medium 6.1

  • CVE-2024-35701login required≤ 2.0.13

    WordPress PropertyHive plugin <= 2.0.13 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2024-34381login required≤ 2.0.10

    WordPress PropertyHive plugin <= 2.0.10 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2025-66087login required≤ 2.1.12

    WordPress PropertyHive plugin <= 2.1.12 - Broken Access Control vulnerability

    Medium 4.3

  • CVE-2024-37204login required≤ 2.0.9

    WordPress PropertyHive plugin <= 2.0.9 - Broken Access Control vulnerability

    Medium 4.3

  • CVE-2024-3607subscriber+≤ 2.0.12

    PropertyHive <= 2.0.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory