What is the CVSS score of CVE-2026-57398?

CVE-2026-57398 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Real Estate Manager Pro are affected by CVE-2026-57398?

The WebCodingPlace Real Estate Manager Pro WordPress plugin (versions through 12.8.3) contains a reflected cross-site scripting vulnerability enabling remote attackers to execute arbitrary JavaScript…

How to fix or mitigate CVE-2026-57398?

Within 24 hours, conduct a complete inventory of WordPress instances running the affected plugin (versions ≤12.8.3) and classify by operational criticality; disable the plugin immediately on non-essential systems. Within 7 days, deploy Web Application Firewall rules to detect and block malicious payloads targeting the plugin's reflected XSS vectors, implement Content Security Policy headers to restrict inline script execution, and document all instances still requiring the plugin functionality for prioritization. Within 30 days, establish a monitoring schedule for WebCodingPlace security advisories, evaluate plugin alternatives or replacement solutions, and plan a migration timeline; engage the vendor for patch availability estimates and security roadmap.

Real Estate Manager Pro CVE-2026-57398

EUVD-2026-43471 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

XSS Real Estate Manager Pro

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:00 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace Real Estate Manager Pro real-estate-manager-pro allows Reflected XSS.This issue affects Real Estate Manager Pro: from n/a through <= 12.8.3.

AnalysisAI

Reflected cross-site scripting in the WebCodingPlace Real Estate Manager Pro WordPress plugin (all versions up to and including 12.8.3) allows a remote attacker to inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. Because the CVSS scope is changed (S:C), successful execution can affect the broader WordPress session/DOM beyond the vulnerable component. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, conduct a complete inventory of WordPress instances running the affected plugin (versions ≤12.8.3) and classify by operational criticality; disable the plugin immediately on non-essential systems. …

Threat intelligence, references, and detailed analysis are available after sign-in.