What is the CVSS score of CVE-2026-57701?

CVE-2026-57701 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Real Estate Manager Pro are affected by CVE-2026-57701?

Real Estate Manager Pro WordPress plugin (versions through 12.8.5) contains a session-hijacking vulnerability that allows attackers to compromise administrative accounts through phishing tactics,…

How to fix or mitigate CVE-2026-57701?

Within 24 hours, audit all WordPress installations to identify Real Estate Manager Pro through version 12.8.5 and document the number of affected sites and accounts. Within 7 days, either uninstall the plugin or implement Web Application Firewall rules blocking reflected XSS payloads targeting plugin parameters. Within 30 days, monitor WebCodingPlace for patch releases and identify alternative real estate management solutions with active security support; if the plugin remains in use, restrict its access to non-administrative user roles only.

Real Estate Manager Pro CVE-2026-57701

EUVD-2026-48173 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-gxqm-wp98-j67j

WordPress XSS Wordpress Plugin Real Estate Manager Pro Webcodingplace

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network reflected XSS requiring a victim click (UI:R) with a scope change into the browser session; Low C/I/A consistent with typical reflected XSS impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:21 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5 versions.

AnalysisAI

Reflected Cross-Site Scripting in the WebCodingPlace 'Real Estate Manager Pro' WordPress plugin (all versions through 12.8.5) lets an unauthenticated remote attacker inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. Because CVSS marks a scope change (S:C), successful exploitation can affect resources beyond the plugin - typically hijacking the authenticated WordPress session/admin context of whoever clicks. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS base score is 7.1 (High).

Technical ContextAI

The affected component is Real Estate Manager Pro, a commercial WordPress plugin (CPE cpe:2.3:a:webcodingplace:real_estate_manager_pro) used to publish property listings on WordPress sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a reflected variant: user-supplied request data (e.g., a search or listing parameter) is echoed back into an HTML response without proper output encoding or input sanitization, so an attacker-controlled string is parsed as active script by the browser. Reflected XSS requires the payload to travel in the request each time, which is why the CVSS vector includes UI:R - a victim must load the attacker's crafted URL.

RemediationAI

Upgrade Real Estate Manager Pro to a release newer than 12.8.5 once the vendor publishes a fixed version; the input data does not include an exact fixed version, so no vendor-released patch version is independently confirmed at time of analysis - monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/real-estate-manager-pro/vulnerability/wordpress-real-estate-manager-pro-plugin-12-8-5-reflected-cross-site-scripting-xss-vulnerability) and the WebCodingPlace changelog for the patched build. Until a patch is applied, place the site behind a WAF (Patchstack or equivalent) with a virtual patch/XSS rule for this plugin, which blocks the reflected payload with minimal functional impact; alternatively restrict or disable the vulnerable plugin endpoints (for example the public search/listing parameters) if they are not business-critical, accepting reduced front-end functionality. Advising administrators not to click untrusted links to the site and enforcing a restrictive Content-Security-Policy further reduces the chance a reflected payload executes.