CVE-2026-1845

Vulnerability

Overview The Real Estate Pro plugin for WordPress, versions up to and including 1.0.9, contains a stored cross-site scripting (XSS) vulnerability in its admin settings. The root cause is insufficient input sanitization and output escaping, allowing malicious scripts to be stored and later executed [1].

Exploitation

Conditions Exploitation requires an authenticated attacker with administrator-level permissions. The vulnerability only affects multi-site installations or environments where the unfiltered_html capability has been disabled. This limits the attack surface to specific WordPress configurations [1].

Impact

Successful exploitation enables an attacker to inject arbitrary web scripts into pages. These scripts execute whenever a user accesses the compromised page, potentially leading to session hijacking, defacement, or further compromise [1].

Mitigation

The plugin has been closed as of March 6, 2026, and is no longer available for download. Users are advised to remove the plugin and replace it with an alternative solution. No patch is available [1].