The vulnerability originates from insufficient filtering of file upload inputs in the admin/tools.php interface of RealtyScript 4.0.2. Attackers can craft file POST requests that embed JavaScript, which is stored and later served within the context of the administrative tool page. This allows the execution of arbitrary client‑side code when other users visit the affected page, potentially compromising user credentials, session tokens, or sensitive data via classic XSS practices. The weakness is cataloged as CWE-79 – Improper Neutralization of Input during Web Page Generation.

Only Next Click Ventures RealtyScript version 4.0.2 is impacted as identified by the vendor’s product listing and the CPE string available in the CVE entry. No other product variants or versions are indicated as affected.

The severity of the flaw is scored as moderate (CVSS 5.1) with a very low probability of exploitation (EPSS <1%). It is not listed in the CISA KEV catalog. Exploitation requires access to the file upload endpoint, which is typically restricted to administrators or users with upload privileges, and relies on other users subsequently accessing the stored file. Given the low exploit probability and moderate impact, audit and patching remain the primary defenses.