Next Click Ventures RealtyScript 4.0.2 contains two critical vulnerabilities: a persistent cross‑site scripting (XSS) flaw that allows an attacker to inject and execute JavaScript in the context of the application, and a cross‑site request forgery (CSRF) flaw that lets an attacker cause an authenticated user to perform privileged administrative actions without their consent. The XSS flaw may enable session hijacking, phishing, or the execution of client‑side code that can exfiltrate data, while the CSRF flaw bypasses any user‑initiated confirmation and can result in data modification, deletion, or escalation of privileges within the application.

Only Next Click Ventures RealtyScript 4.0.2 is affected. Explicit CPE data confirms the product and version: cpe:2.3:a:nextclickventures:realtyscript:4.0.2:*:*:*:*:*:*.*. No other versions or vendors are listed in the provided information.

The CVSS score of 6.9 indicates medium severity. An EPSS score of less than 1 % suggests a low likelihood of current exploitation, and the vulnerability is not listed in the CISA KEV catalog, implying no widely‑publicized exploits. Exploitation requires an attacker to supply a malicious web page that a logged‑in user will visit or to craft a forged request that the application will accept, and thus hinges on a web‑based attack vector. The weakness is discovered via client‑side manipulation rather than server‑side code execution.