CVE-2026-57701
HighCVSS 7.1Summary
The Real Estate Manager Pro plugin version 12.8.5 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
Risk Assessment
Risk includes session hijacking, redirection to malicious sites, or theft of sensitive data. The attack does not require authentication, increasing the attack surface.
Recommendation
Immediately update the Real Estate Manager Pro plugin to the latest available version. Also consider deploying a Web Application Firewall (WAF) to block common XSS patterns.
Other vulnerabilities in Real Estate Manager Pro
See all- CVE-2026-15142High
The Real Estate Manager Pro plugin for WordPress up to version 12.8.6 is vulnerable to privilege escalation. The allow_attachment_actions() function has improper capability handling, which can treat a target user ID as a media attachment ID during user capability checks. This allows authenticated attackers with Subscriber-level access and above to edit an administrator account and escalate their privileges to Administrator when the targeted user ID matches the ID of an existing media attachment.
- CVE-2026-57398High
The Real Estate Manager Pro WordPress plugin contains a reflected Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject malicious JavaScript code into an HTTP request, which will be executed in the victim's browser.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5 versions.