Real Estate Manager EUVD-2026-89683

Requires an authenticated account with subscriber-level access or above on a WordPress site running Real Estate Manager - Property Listing and Agent Management version ≤7.3; the plugin must be installed and active. Exploitation targets the wp_ajax_rem_create_pro_ajax AJAX handler, which lacks any capability, nonce, or ownership check, and the 'before_price_text' value is stored via update_post_meta (not post_content), so wp_kses/unfiltered_html protections do not apply. What LIMITS exploitation: the attacker needs a valid low-privilege login (PR:L, so not fully unauthenticated), and script execution depends on a victim subsequently viewing the injected page (the scope-change impact lands on that viewer).

This is a genuine but moderate-priority issue rather than a critical one. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, base 6.4) reflects a network-reachable stored XSS requiring only subscriber-level authentication, with a scope change (S:C) because injected script executes in the browsers of other users/administrators who view the affected page. Impact is limited to C:L/I:L (session/token theft, limited content manipulation) with no availability impact. No EPSS score, KEV listing, or SSVC decision data was provided, and no public exploit is referenced - this is a Wordfence Threat Intelligence disclosure with source-code line references but no weaponized PoC. The notable aggravating factor called out in the description is a complete absence of capability, nonce, and ownership checks on the wp_ajax_rem_create_pro_ajax handler, plus persistence via update_post_meta (bypassing the wp_kses/unfiltered_html filtering that normally protects post_content), which lowers the practical barrier to injection for any logged-in user. Overall a real, patch-worthy vulnerability but not an emergency: exploitation still requires a valid low-privilege account and a victim viewing the injected page.

An attacker registers or obtains a subscriber-level account on a WordPress site running Real Estate Manager ≤7.3, then sends a crafted request to the unprotected wp_ajax_rem_create_pro_ajax AJAX handler with a malicious 'before_price_text' value containing script. The payload is stored via update_post_meta and later rendered unescaped, so when an administrator or visitor opens the affected listing page the script executes in their session. No public PoC is referenced, though Wordfence provides the exact vulnerable source lines.