The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… (CVE-2026-96667)

The Real Estate Manager – Property Listing and Agent Management plugin for WordPress suffers from a stored cross-site scripting vulnerability via the 'first_name' parameter in all versions up to and including 7.3. The root cause is insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. The reCAPTCHA check intended to prevent automated abuse is trivially bypassed by omitting the g-recaptcha-response parameter, as validation only occurs if this parameter is present.

Successful exploitation allows attackers to inject and execute arbitrary scripts in the context of affected users' browsers, potentially leading to session hijacking, defacement, or other malicious actions. The vulnerability is exploitable without authentication and does not require user interaction, increasing its risk. The CVSS score of 7.2 (High) reflects the network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the plugin or restricting access to affected functionality. The trivial bypass of the reCAPTCHA indicates it cannot be relied upon as a mitigation. Implementing additional input validation and output encoding at the application level may reduce risk temporarily.