Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Real Estate Pro real-estate-pro allows Reflected XSS.This issue affects Real Estate Pro: from n/a through <= 2.1.4.
Published: 2026-01-08
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Improper neutralization of user input during page generation in the Real Estate Pro plugin allows an attacker to embed malicious scripts that are reflected in the victim’s browser. This reflected XSS flaw is identified as CWE‑79 and can enable e‑mail login hijacking, phishing, or the execution of arbitrary JavaScript in the context of the user’s session.

Affected Systems

The vulnerability affects the e‑plugins Real Estate Pro WordPress plugin versions through 2.1.4. Any installation of the plugin at or below this version is susceptible to the reflected XSS issue.

Risk and Exploitability

The CVSS score of 7.1 indicates a high impact potential, while the EPSS score of less than 1% suggests that exploitation probability is currently low. The vulnerability is not listed in the CISA KEV catalog. Based on the description the likely attack vector is a crafted URL or query string that a victim is tricked into visiting, which would cause the reflected script to run in the victim’s browser.

Generated by OpenCVE AI on May 1, 2026 at 05:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Real Estate Pro plugin to the latest version (≥ 2.1.5) to address the reflected XSS fix.
  • Reconfigure the plugin to strictly enforce proper input validation and output encoding for all user‑supplied data.
  • Deploy a web application firewall or content security policy that blocks or neutralizes reflected XSS payloads.

Generated by OpenCVE AI on May 1, 2026 at 05:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

 cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Tue, 20 Jan 2026 15:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
References

Fri, 09 Jan 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared E-plugins
E-plugins real Estate Pro
Wordpress
Wordpress wordpress
Vendors & Products E-plugins
E-plugins real Estate Pro
Wordpress
Wordpress wordpress

Thu, 08 Jan 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 08 Jan 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Thu, 08 Jan 2026 09:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Real Estate Pro real-estate-pro allows Reflected XSS.This issue affects Real Estate Pro: from n/a through <= 2.1.4.
Title WordPress Real Estate Pro plugin <= 2.1.4 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References

Subscriptions

E-plugins Real Estate Pro
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:10:57.468Z

Reserved: 2025-11-21T11:24:21.595Z

Link: CVE-2025-13504

cve-icon Vulnrichment

Updated: 2026-01-08T15:05:08.898Z

cve-icon NVD

Status : Deferred

Published: 2026-01-08T10:15:45.517

Modified: 2026-04-27T17:16:24.233

Link: CVE-2025-13504

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-01T06:00:13Z

Weaknesses