Stored Cross-Site Scripting Vulnerability in Real Estate Pro Plugin for WordPress

CVE-2026-1845

What is CVE-2026-1845?

The Real Estate Pro plugin for WordPress suffers from a Stored Cross-Site Scripting (XSS) vulnerability caused by inadequate input sanitization and output escaping within its admin settings. This flaw allows authenticated attackers, specifically those with administrator privileges, to inject arbitrary web scripts into pages. When users visit these compromised pages, any injected scripts execute, potentially leading to serious security issues. This vulnerability primarily affects multi-site installations and those setups where unfiltered_html capability is turned off, creating an avenue for attackers to exploit the system.

References