Key detail from the vulnerability description: "Next Click Ventures RealtyScript 4.0.2 contains a cross‑site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious input through multiple parameters that are not properly sanitized." The flaw permits injection of arbitrary script into the web page rendering context of a victim’s browser, creating a client‑side code execution vulnerability that maps to CWE‑79.

Key detail from the vendor’s product list: Next Click Ventures RealtyScript 4.0.2 is the affected product. The CPE string cpe:2.3:a:nextclickventures:realtyscript:4.0.2:*:*:*:*:*:*:* identifies the exact affected version. No other versions are listed as vulnerable.

Key detail from CVSS scoring: 5.1 indicates a moderate severity impact. Key detail from EPSS scoring: <1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector appears to be remote via crafted HTTP requests to the application’s vulnerable parameters. Therefore the risk is moderate, with potential for client‑side code execution if an attacker can send malicious requests.