Qode Real Estate
Monthly
Cross-site scripting in the Qode Real Estate WordPress plugin (all versions up to and including 1.1.7.3) lets unauthenticated attackers deliver crafted input that executes as script in a victim's browser session on the affected site. Exploitation requires no authentication but does require victim interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) - a victim must click a crafted link or load attacker-influenced content before the payload runs, so there is no silent server-side compromise. No public exploit identified at time of analysis and no CISA KEV listing; signals are mixed and lean toward moderate rather than urgent priority, and the exact injectable parameter is not detailed in the available description so the Patchstack advisory should be consulted for the precise entry point.
Cross-site scripting in the Qode Real Estate WordPress plugin (all versions up to and including 1.1.7.3) lets unauthenticated attackers deliver crafted input that executes as script in a victim's browser session on the affected site. Exploitation requires no authentication but does require victim interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) - a victim must click a crafted link or load attacker-influenced content before the payload runs, so there is no silent server-side compromise. No public exploit identified at time of analysis and no CISA KEV listing; signals are mixed and lean toward moderate rather than urgent priority, and the exact injectable parameter is not detailed in the available description so the Patchstack advisory should be consulted for the precise entry point.