CVE-2026-57398
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Real Estate Manager Pro WordPress plugin contains a reflected Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject malicious JavaScript code into an HTTP request, which will be executed in the victim's browser.
Risk Assessment
The risk includes session hijacking, redirection to malicious sites, or unauthorized actions performed in the context of an administrator session. This could lead to full compromise of the WordPress site.
Recommendation
Immediately update the Real Estate Manager Pro plugin to a version higher than 12.8.3. If no update is available, temporarily disable the plugin until a patch is released.
Other vulnerabilities in Real Estate Manager Pro
See all- CVE-2026-57701High
The Real Estate Manager Pro plugin version 12.8.5 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
- CVE-2026-15142High
The Real Estate Manager Pro plugin for WordPress up to version 12.8.6 is vulnerable to privilege escalation. The allow_attachment_actions() function has improper capability handling, which can treat a target user ID as a media attachment ID during user capability checks. This allows authenticated attackers with Subscriber-level access and above to edit an administrator account and escalate their privileges to Administrator when the targeted user ID matches the ID of an existing media attachment.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace Real Estate Manager Pro real-estate-manager-pro allows Reflected XSS.This issue affects Real Estate Manager Pro: from n/a through <= 12.8.3.