The vulnerability is an improper neutralization of user input during web page generation, resulting in a reflected cross‑site scripting (XSS) flaw. An attacker could inject malicious scripts that execute in the context of a victim’s browser, potentially stealing session data, defacing content, or performing malicious actions on behalf of the user. This weakness aligns with CWE‑79 and leads to a loss of confidentiality and integrity for users who view the affected pages.

The flaw affects the WebCodingPlace Real Estate Manager Pro plugin for WordPress; all versions from the earliest available release through 12.7.3 are vulnerable.

The CVSS score of 7.1 places this vulnerability in the high‑severity range. However, the EPSS score is listed as < 1 %, indicating a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Most likely, exploitation would occur via a crafted URL or form submission that the victim unknowingly processes, exploiting the lack of output encoding to inject script payloads.