The Real Estate Pro plugin for WordPress contains a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated users with administrator-level permissions can inject arbitrary scripts via admin settings, which execute when other users access the affected pages. This vulnerability specifically affects multi-site installations or sites where unfiltered_html is disabled, and impacts all versions up to and including 1.0.9. The CVSS 3.1 base score is 5.5, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. No patch or official remediation has been published by the vendor as of the current data.

An attacker with administrator-level access on affected WordPress multi-site installations or sites with unfiltered_html disabled can inject persistent malicious scripts. This can lead to unauthorized script execution in the context of users visiting the injected pages, potentially compromising confidentiality and integrity of data accessible to those users. Availability is not impacted. The vulnerability requires high privileges and does not require user interaction to trigger once the malicious script is stored.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and consider disabling or limiting use of the Real Estate Pro plugin in multi-site environments or where unfiltered_html is disabled. Monitor vendor channels for updates and apply patches promptly once available.