The Real Estate Manager WordPress plugin (up to version 7.3) has a stored cross‑site scripting flaw that results from insufficient filtering of the ‘first_name’ parameter and the absence of output escaping. An attacker can submit a string containing malicious JavaScript via this field and have it saved in the database. When other users view the affected page, the browser executes the injected script, allowing the attacker to steal cookies, deface the site, or perform further actions in the context of the victim’s session. The same vulnerability also exposes the reCAPTCHA check to bypass, because the validation routine only runs when the 'g‑recaptcha‑response' field is present, meaning attackers can submit the form without completing the challenge.

The vulnerability affects the WordPress plugin Real Estate Manager – Property Listing and Agent Management, specifically all releases <= 7.3. Users running any of those releases have the potential to be exploited by outputting unescaped content in agent listing pages.

With a CVSS score of 7.2 the flaw represents a moderate‑high risk. Attackers need only craft an HTTP request to the agent submission form; no authentication is required to inject the payload. Because the plugin is widely deployed in WordPress sites, the opportunity for real exploitation is high. EPSS data is currently unavailable, but the lack of a KEV listing suggests that a publicly known exploit has not yet been released. Nonetheless, the potential for browser‑side damage and credential theft remains significant.