CVE-2025-2906 is a stored cross-site scripting vulnerability in the Contempo Real Estate Core WordPress plugin (up to version 3.6.3). The issue arises from improper neutralization of input during web page generation, specifically insufficient input sanitization and output escaping of shortcode attributes. Authenticated users with contributor-level or higher permissions can inject arbitrary JavaScript that executes in the context of users visiting the injected pages. This vulnerability can lead to limited confidentiality and integrity impacts but does not affect availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at low level, no user interaction, and scope changed.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages via shortcode attributes. These scripts execute in the browsers of users who view the affected pages, potentially leading to theft of user data or session tokens (confidentiality impact) and modification of displayed content (integrity impact). Availability is not impacted. The vulnerability requires authenticated access, limiting exposure to users with contributor or higher roles.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict contributor-level and higher permissions to trusted users only and consider disabling or limiting use of shortcodes in the Contempo Real Estate Core plugin. Monitor vendor channels for updates and apply patches promptly once available.