Real Estate 7 CVE-2026-57343

Exploitation requires no authentication (PR:N) but does require victim user interaction (UI:R) - a target must click an attacker-crafted link or visit a page carrying the malicious payload - and the site must run Real Estate 7 theme version 3.5.9 or earlier. The vulnerability is network-reachable against default installations, but its real-world impact is gated by whom the attacker lures: targeting an authenticated administrator yields far greater impact than an anonymous visitor. The scope change (S:C) means the injected script runs in the victim's browser session rather than being confined to the theme's server-side context. The precise vulnerable parameter or feature is not specified in the provided data and should be confirmed via the Patchstack advisory.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1 High) shows a network-reachable, low-complexity flaw requiring no privileges but requiring user interaction, with a scope change (S:C) reflecting that injected script executes in the browser context beyond the vulnerable component - the hallmark of XSS. The low confidentiality/integrity/availability impacts (C:L/I:L/A:L) are typical for XSS, where damage depends on what the victim can do; if an administrator is targeted, real-world impact can escalate well beyond the base metrics. No EPSS score, KEV entry, or POC was provided, so exploitation likelihood cannot be quantified from the data - the primary risk signal is Patchstack's confirmation of the vulnerability class. The UI:R requirement (victim must click a link or visit a crafted page) meaningfully limits mass, hands-off exploitation compared to a no-interaction flaw.

An attacker crafts a URL pointing at a Real Estate 7 site with a malicious script embedded in a reflected parameter and distributes it via email or a listing link. When a logged-in site administrator or visitor clicks the link, the script executes in their browser under the site's origin, allowing session cookie theft, CSRF-token exfiltration, or actions performed as that user. No public POC is identified, but the low attack complexity means a working payload is straightforward to develop once the vulnerable parameter is known.