Threats tagged 'ghsa-jm7p-f6m7-xr3m'

The Real Estate Manager plugin for WordPress suffers from a stored cross-site scripting (XSS) vulnerability via the 'before_price_text' parameter in all versions up to and including 7.3. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises due to insufficient input sanitization and output escaping, lack of capability, nonce, or ownership checks on the AJAX handler, and the use of update_post_meta which bypasses typical filtering mechanisms.