What is the CVSS score of CVE-2026-1845?

CVE-2026-1845 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Real Estate Pro CVE-2026-1845

EUVD-2026-24635 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-22 Wordfence

GHSA-whv2-j4r9-wvjx

XSS WordPress

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 10:00 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24635

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 5.5

DescriptionCVE.org

The Real Estate Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

AnalysisAI

Stored Cross-Site Scripting in Real Estate Pro plugin for WordPress up to version 1.0.9 allows authenticated administrators to inject arbitrary JavaScript into admin settings that executes for all users viewing affected pages. The vulnerability is limited to multi-site installations or single-site instances with the unfiltered_html capability disabled. Attack requires administrator-level privileges and no user interaction, but scope is changed (cross-site impact), resulting in a moderate CVSS score of 5.5.

Technical ContextAI

Real Estate Pro is a WordPress plugin vulnerable to Stored XSS (CWE-79) due to insufficient input sanitization in admin settings and lack of output escaping when rendering stored data. WordPress has a capability system; the unfiltered_html capability allows unrestricted HTML/JavaScript in posts. When this capability is disabled or in multi-site mode (where it's disabled by default), the plugin fails to properly sanitize user input before storage and escape it during output, allowing stored malicious scripts to persist and execute in the DOM whenever affected pages are accessed. The CPE identifier (cpe:2.3:a:bhubbard:real_estate_pro) indicates the vulnerable component is the application itself, not a third-party library.

RemediationAI

Upgrade Real Estate Pro to a version newer than 1.0.9 once available from the plugin developer (no patched version number confirmed in available data). Wordfence threat intelligence page (https://www.wordfence.com/threat-intel/vulnerabilities/id/1978fd4f-f130-4e72-85df-24a6f9aebfe2) should be monitored for patch availability and release notes. Until a patch is released, administrators should implement the following compensating controls: (1) Restrict admin settings access to a minimal number of trusted administrators by using role-based access control and removing administrator capabilities from accounts that do not require them - this directly reduces the attack surface; (2) Enable security monitoring on wp-admin pages and audit logs to detect unauthorized changes to plugin settings; (3) If the plugin is not actively in use, disable or delete it entirely, eliminating the vector. For multi-site installations or environments where unfiltered_html is disabled by policy, consider temporarily re-enabling unfiltered_html only for trusted administrators if operationally feasible, though this trades off content restriction for security. Organizations should verify with Wordfence and the plugin author (bhubbard) when updates are released.