The plugin contains an improper neutralization of input during web page generation, leading to stored cross‑site scripting. Malicious script can be injected into the plugin’s settings or property listings and will execute automatically when any site visitor loads the affected page. The same flaw also allows cross‑site request forgery of settings changes, enabling an attacker to alter configuration without authenticating as an administrator.

WordPress sites running Estatebud – Properties & Listings plugin version 5.5.0 or older are vulnerable. The issue affects the entire plugin regardless of WordPress version, as the flaw resides in the plugin’s code.

The CVSS score of 7.1 classifies the vulnerability as high severity; the EPSS score is less than 1 %, indicating a low current exploitation probability but still a valid risk. The flaw is not listed in the CISA KEV catalog. Attack requires only a web request that injects payload into a writable setting or listing; no privileged authentication is needed, making it exploit-able by any user with access to the website’s front‑end. If leveraged, an attacker could steal session cookies, deface the site or deliver malware to visitors.