Description
The Real Estate Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Published: 2026-04-22
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting via admin settings
Action: Patch Now
AI Analysis

Impact

The Real Estate Pro WordPress plugin allows an authenticated attacker with administrator privileges to inject arbitrary JavaScript into stored settings. When another user visits the affected page, the injected script executes in their browser, potentially compromising their session or defacing the site. This is a classic Stored XSS flaw (CWE‑79).

Affected Systems

The vulnerability affects installations of Real Estate Pro version 1.0.9 or earlier, specifically when WordPress is configured as a multi‑site network and the unfiltered_html capability is disabled. The plugin is distributed by the vendor bhubbard.

Risk and Exploitability

With a CVSS score of 5.5 the flaw is moderate but still significant, especially given that it requires only an authenticated admin account. No public exploit is documented and the EPSS score is not available, but the risk remains due to the potential for malicious script injection. The vulnerability is not listed in the CISA KEV catalog, yet its impact on user data and trustworthiness makes patching advisable.

Generated by OpenCVE AI on April 22, 2026 at 09:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Real Estate Pro to a patched release (e.g., 1.1 or later)
  • Verify that mult‑site configurations are securely managed, ensuring that unfiltered_html is disabled for non‑trusted content
  • If an upgrade is not immediately possible, remove the plugin or replace it with a secure alternative

Generated by OpenCVE AI on April 22, 2026 at 09:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 22 Apr 2026 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Bhubbard
Bhubbard real Estate Pro
Wordpress
Wordpress wordpress
Vendors & Products Bhubbard
Bhubbard real Estate Pro
Wordpress
Wordpress wordpress

Wed, 22 Apr 2026 08:30:00 +0000

Type Values Removed Values Added
Description The Real Estate Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Title Real Estate Pro <= 1.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting via Settings
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Bhubbard Real Estate Pro
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-22T12:16:59.467Z

Reserved: 2026-02-03T18:06:05.697Z

Link: CVE-2026-1845

cve-icon Vulnrichment

Updated: 2026-04-22T12:16:54.187Z

cve-icon NVD

Status : Deferred

Published: 2026-04-22T09:16:20.650

Modified: 2026-04-22T20:22:50.570

Link: CVE-2026-1845

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T11:44:23Z

Weaknesses