Real Estate Manager Pro vulnerabilities

The Real Estate Manager Pro plugin version 12.8.5 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

The Real Estate Manager Pro plugin for WordPress up to version 12.8.6 is vulnerable to privilege escalation. The allow_attachment_actions() function has improper capability handling, which can treat a target user ID as a media attachment ID during user capability checks. This allows authenticated attackers with Subscriber-level access and above to edit an administrator account and escalate their privileges to Administrator when the targeted user ID matches the ID of an existing media attachment.

The Real Estate Manager Pro WordPress plugin contains a reflected Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject malicious JavaScript code into an HTTP request, which will be executed in the victim's browser.