Threat database

The Real Estate Manager – Property Listing and Agent Management WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the 'first_name' parameter in all versions up to and including 7.3. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. The plugin's reCAPTCHA validation can be bypassed by omitting the g-recaptcha-response parameter, making exploitation easier. The vulnerability has a high severity rating with a CVSS score of 7.2.

The Real Estate Manager – Property Listing and Agent Management WordPress plugin up to version 7.3 is vulnerable to stored cross-site scripting (XSS) via the 'before_price_text' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and lack of capability, nonce, or ownership checks in the AJAX handler responsible for saving this data. Because the injected value is stored in post metadata rather than post content, standard WordPress filtering does not apply.