Real Estate Manager Property Listing And Agent Management
Monthly
Unauthenticated attackers can store arbitrary JavaScript in the WordPress 'Real Estate Manager - Property Listing and Agent Management' plugin (all versions up to and including 7.3) by submitting a crafted 'first_name' value through the public agent registration form, with the payload executing when an administrator later opens the Agents admin page where the value is rendered unescaped. The plugin's reCAPTCHA control provides no practical barrier because validation only runs when the g-recaptcha-response parameter is present, so simply omitting that parameter bypasses the check entirely. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited, but the requirement for a privileged user to view the injected page keeps this a moderate-priority rather than emergency issue; version 7.4 fixes it.
Stored cross-site scripting in the WordPress plugin Real Estate Manager - Property Listing and Agent Management affects all versions up to and including 7.3, allowing a low-privileged authenticated user (subscriber or above) to persist arbitrary JavaScript through the 'before_price_text' parameter that then executes in the browser of any visitor viewing the injected page. The flaw is compounded by the wp_ajax_rem_create_pro_ajax AJAX handler having no capability, nonce, or ownership check, and because the payload is saved with update_post_meta rather than into post_content, the wp_kses filtering normally tied to the unfiltered_html capability never applies. Rated CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), this is a genuine but moderate-priority issue; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated attackers can store arbitrary JavaScript in the WordPress 'Real Estate Manager - Property Listing and Agent Management' plugin (all versions up to and including 7.3) by submitting a crafted 'first_name' value through the public agent registration form, with the payload executing when an administrator later opens the Agents admin page where the value is rendered unescaped. The plugin's reCAPTCHA control provides no practical barrier because validation only runs when the g-recaptcha-response parameter is present, so simply omitting that parameter bypasses the check entirely. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited, but the requirement for a privileged user to view the injected page keeps this a moderate-priority rather than emergency issue; version 7.4 fixes it.
Stored cross-site scripting in the WordPress plugin Real Estate Manager - Property Listing and Agent Management affects all versions up to and including 7.3, allowing a low-privileged authenticated user (subscriber or above) to persist arbitrary JavaScript through the 'before_price_text' parameter that then executes in the browser of any visitor viewing the injected page. The flaw is compounded by the wp_ajax_rem_create_pro_ajax AJAX handler having no capability, nonce, or ownership check, and because the payload is saved with update_post_meta rather than into post_content, the wp_kses filtering normally tied to the unfiltered_html capability never applies. Rated CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), this is a genuine but moderate-priority issue; no public exploit code or confirmed active exploitation was identified at time of analysis.