Real Estate Manager EUVD-2026-96099

Exploitation requires that the plugin's public-facing agent registration/submission form be enabled and reachable, which is the condition under which the 'first_name' field is accepted from unauthenticated users. The documented reCAPTCHA protection does not limit exploitation because validation only executes when g-recaptcha-response is present, so omitting that parameter entirely bypasses it. Full impact (script execution) additionally requires a privileged user - typically an administrator - to later view the Agents admin page where the unescaped value is rendered; this victim-side page view is the primary limiting factor, though no explicit click beyond opening the page is needed. Affected: all versions up to and including 7.3; fixed in 7.4.

This is a genuine but moderate-priority web vulnerability, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) indicates network reachability, low complexity, no privileges and no user interaction for the injection step, with a scope change reflecting that the stored payload executes in other users' browser contexts. This aligns with the description: an unauthenticated attacker injects a stored XSS payload via 'first_name', and the reCAPTCHA gate is trivially defeated by omitting the g-recaptcha-response parameter, so the only intended barrier is effectively absent. No EPSS score was provided, the CVE is not in CISA KEV, and no public proof-of-concept is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The signals are therefore consistent rather than conflicting (no confirmed exploitation evidence, moderate CVSS). The main nuance is impact context: stored XSS rendered on an Agents admin page is dangerous because it can execute in an administrator's authenticated session, but impact is bounded (C:L/I:L, A:N) and requires a privileged user to view the poisoned page. Treat as a should-patch-promptly issue, especially on sites exposing public agent registration, rather than a drop-everything incident.

An unauthenticated attacker submits the plugin's agent registration form with a malicious script in the 'first_name' field, sending the request without any g-recaptcha-response parameter so the reCAPTCHA check never runs. The payload is stored and later rendered unescaped on the Agents admin page, so when an administrator opens that page the script executes in their authenticated session, enabling session/cookie theft or admin actions. No public exploit is identified, but the low complexity (AC:L) and lack of required privileges or interaction for injection make weaponization straightforward.