Contempo Real Estate Core suffers a stored XSS flaw that allows an authenticated attacker with contributor or higher privileges to inject arbitrary JavaScript via shortcode attributes. The unsanitized input is rendered in page content, meaning any visitor who views the affected page will execute the code in their browser. This can lead to client‑side session hijacking, credential theft, defacement, or further phishing attacks, effectively compromising the confidentiality and integrity of user sessions.

All WordPress sites that use the Contempo Real Estate Core plugin in versions 3.6.3 or earlier are impacted. The vulnerability is tied to the plugin’s shortcode handling and does not affect the core WordPress engine itself.

The CVSS score of 6.4 classifies the issue as high severity. The EPSS score of less than 1% indicates that, at the time of analysis, exploitation is relatively unlikely, and the vulnerability is not listed in CISA KEV. Attack requires valid contributor or higher credentials; the attacker must create or modify a shortcode containing malicious JavaScript, which is then stored and executed whenever any user loads the page with that shortcode.