What is the CVSS score of CVE-2026-57343?

CVE-2026-57343 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Real Estate 7 are affected by CVE-2026-57343?

The Real Estate 7 WordPress theme (contempoinc, versions 3.5.9 and earlier) contains a cross-site scripting vulnerability allowing unauthenticated attackers to inject arbitrary JavaScript into…

How to fix or mitigate CVE-2026-57343?

Within 24 hours: Conduct asset inventory to identify all sites using Real Estate 7 theme version 3.5.9 or earlier; flag critical or customer-facing properties for immediate triage. Within 7 days: Deploy Web Application Firewall (WAF) rules targeting reflected and stored XSS patterns; enforce Content Security Policy (CSP) headers with script-src and frame-ancestors restrictions on all affected sites. Within 30 days: Monitor Patchstack and vendor advisories for patch release; prepare staged upgrade plan and test patched version in pre-production; consider theme migration if patch timeline extends beyond organizational risk tolerance.

Real Estate 7 CVE-2026-57343

EUVD-2026-41343 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-v47f-fhqp-6ffw

WordPress XSS Real Estate 7 Wordpress Theme

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network XSS (PR:N, AV:N) needing victim click (UI:R); injected script crosses into the browser context (S:C) with limited C/I/A impact typical of XSS.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:12 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 <= 3.5.9 versions.

AnalysisAI

Reflected/stored Cross-Site Scripting in the Real Estate 7 WordPress theme (contempoinc) versions 3.5.9 and earlier lets unauthenticated remote attackers inject arbitrary JavaScript that executes in a victim's browser when they interact with a crafted link or page. The scope-changing flaw (CVSS 3.1 7.1) can hijack sessions or perform actions in the victim's authenticated context, including administrators. Reported by Patchstack; no public exploit code has been identified and it is not on the CISA KEV list.

Technical ContextAI

The affected component is Real Estate 7, a commercial WordPress theme by ContempoInc used to build property-listing and real-estate agency websites (CPE cpe:2.3:a:contempoinc:real_estate_7). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input is reflected or stored into HTML output without adequate output encoding or input sanitization. Because WordPress themes render dynamic content (search parameters, listing fields, form inputs) directly into pages, an unsanitized value allows an attacker to break out of the intended data context and inject an active <script> payload that the browser executes in the site's origin.

RemediationAI

No vendor-released patch version is identified in the provided data, so upgrade to the vendor's latest patched release of Real Estate 7 above 3.5.9 as soon as ContempoInc publishes it, and monitor the Patchstack advisory (https://patchstack.com/database/wordpress/theme/realestate-7/vulnerability/wordpress-real-estate-7-theme-3-5-9-cross-site-scripting-xss-vulnerability?_s_id=cve) for the exact fix version. As compensating controls until a patch is applied, deploy a Web Application Firewall or Patchstack's virtual patching to filter XSS payloads on the theme's request parameters (trade-off: rule tuning may cause false positives on legitimate listing text); set a restrictive Content-Security-Policy that disallows inline script execution to blunt injected payloads (trade-off: may break theme features that rely on inline scripts and requires testing); and restrict or disable the specific theme input/search endpoints that reflect user data if they are not business-critical (trade-off: reduced site functionality).