Qode Real Estate CVE-2026-42632

Reflected/stored XSS in the Qode Real Estate WordPress plugin for all versions up to and including 1.1.7.3; exploitation requires no authentication (PR:N) but DOES require victim user interaction (UI:R) - a victim must click a crafted link or load attacker-influenced content for the payload to execute in their browser. The precise injectable parameter or feature is not detailed in the provided description; consult the Patchstack advisory for the exact entry point. Limiting factors: the mandatory user-interaction step (no silent server-side compromise), the dependency on the plugin being installed and active, and Low-magnitude per-impact scores.

Signals are mixed and lean toward moderate, not urgent, priority. The CVSS 3.1 base score of 7.1 (High) is driven largely by the scope change (S:C), which is standard for stored/reflected XSS where the injected script executes in a victim's browser context rather than the vulnerable server itself; the raw impacts are each only Low (C:L/I:L/A:L). The vector is favorable to attackers on paper - network reachable (AV:N), low complexity (AC:L), and no privileges required (PR:N, i.e. unauthenticated) - but it is materially gated by required user interaction (UI:R), meaning a victim must be lured into triggering the payload. No EPSS score, no CISA KEV listing, and no POC were provided in the input, so there is no evidence of active exploitation or public exploit code; status is therefore 'no public exploit identified at time of analysis.' The combination of a niche WordPress plugin, mandatory user interaction, and Low-magnitude impacts suggests this is a genuine but lower-tier web vulnerability rather than a mass-exploitation threat. Note the A:L (availability) impact in the supplied vector is atypical for XSS and is weakly justified - reflected/stored XSS rarely affects availability; verify against the Patchstack advisory.

An unauthenticated attacker crafts a URL or input containing a malicious script payload targeting the Qode Real Estate plugin (<= 1.1.7.3) and lures a logged-in site visitor or administrator into clicking it. When the victim's browser renders the unsanitized output, the script executes in the site's context, enabling session/cookie theft or actions on behalf of the victim. No public POC or exploit code was identified in the provided intelligence.