CVE-2026-1845 is a stored cross-site scripting vulnerability (CWE-79) in the bhubbard Real Estate Pro WordPress plugin affecting all versions up to 1.0.9. The flaw exists due to improper neutralization of input during web page generation, specifically in admin settings where input is not sufficiently sanitized or escaped. This allows authenticated administrators on multi-site or restricted unfiltered_html installations to inject malicious scripts that execute when other users view the affected pages. The vulnerability has a CVSS 3.1 base score of 5.5, indicating medium severity. No vendor-provided patch or official remediation instructions are currently available.

An attacker with administrator-level permissions on affected WordPress installations can inject persistent malicious scripts into pages via the plugin's admin settings. These scripts execute in the context of users who visit the injected pages, potentially leading to session hijacking, privilege escalation, or other script-based attacks. The vulnerability does not affect single-site installations or those with unfiltered_html enabled. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should restrict access to the plugin's settings to trusted users only and consider disabling or removing the Real Estate Pro plugin on multi-site installations or where unfiltered_html is disabled. Monitoring for plugin updates from bhubbard is recommended to apply any forthcoming patches promptly.