Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
199 results · page 2 of 4
Jul 16, 2025Real Estate Property 2024 Create Your Own Fields and Search Bar WP: Missing AuthorizationCVE-2025-48150 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sminozzi Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin real-estate-right-now allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin: from n/a through <= 4.48.
- Product
- Real Estate Property 2024 Create Your Own Fields and Search Bar WP
- Affected
- up to 4.48
- What to do
- Affects up to 4.48. Update Real Estate Property 2024 Create Your Own Fields and Search Bar WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 2, 2025Home Villas | Real Estate: Arbitrary file deletionCVE-2025-5014 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Home Villas | Real Estate WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'wp_rem_cs_widget_file_delete' function in all versions up to, and including, 2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Product
- Home Villas | Real Estate
- Affected
- up to 2.8
- What to do
- Affects up to 2.8. Update Home Villas | Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlocalhostwordfence.com
Jul 1, 2025The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to CVE-2025-6934 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to privilege escalation via in all versions up to, and including, 1.7.5. This is due to a lack of role restriction during registration in the 'on_regiser_user' function. This makes it possible for unauthenticated attackers to arbitrarily choose the role, including the Administrator role, assigned when registering.
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 20, 2025Real Estate Manager: Cross-Site Request Forgery (CSRF)CVE-2025-52825 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows Privilege Escalation.This issue affects Real Estate Manager: from n/a through <= 7.3.
- Product
- Real Estate Manager
- Affected
- up to 7.3
- What to do
- Affects up to 7.3. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Real Estate Manager: Cross-Site Request Forgery (CSRF)CVE-2025-50044 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows Cross Site Request Forgery.This issue affects Real Estate Manager: from n/a through <= 7.3.
- Product
- Real Estate Manager
- Affected
- up to 7.3
- What to do
- Affects up to 7.3. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025A vulnerability was found in ScriptAndTools Real Estate Management System 1.0.CVE-2025-6329 · Other software · ScriptAndTools · reported by VulDBLow 2.1
A vulnerability was found in ScriptAndTools Real Estate Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file userdelete.php of the component User Delete Handler. The manipulation of the argument ID leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Real Estate Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2025Real Estate Management 1.0 is vulnerable to Cross Site Scripting (XSS) in /store/index.php.CVE-2025-45786 · Other software · Updategadh · reported by MITREHigh 8.1
Real Estate Management 1.0 is vulnerable to Cross Site Scripting (XSS) in /store/index.php.
- Product
- Real Estate Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comupdategadh.com
Jun 10, 2025RH - Real Estate: Privilege EscalationCVE-2025-4601 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The "RH - Real Estate WordPress Theme" theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.0. This is due to the theme not properly restricting user roles that can be updated as part of the inspiry_update_profile() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to set their role to that of an administrator. The vulnerability was partially patched in version 4.4.0, and fully patched in version 4.4.1.
- Product
- RH - Real Estate
- Affected
- up to 4.4.0
- What to do
- Affects up to 4.4.0. Update RH - Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Jun 9, 2025Essential Real Estate: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-48126 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in g5theme Essential Real Estate essential-real-estate allows PHP Local File Inclusion.This issue affects Essential Real Estate: from n/a through <= 5.2.9.
- Product
- Essential Real Estate
- Affected
- up to 5.2.9
- What to do
- Affects up to 5.2.9. Update Essential Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 4, 2025A vulnerability, which was classified as critical, was found in CodeAstro Real Estate Management System 1.0.CVE-2025-5611 · Other software · CodeAstro · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in CodeAstro Real Estate Management System 1.0. This affects an unknown part of the file /submitpropertyupdate.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Real Estate Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Jun 4, 2025A vulnerability, which was classified as critical, has been found in CodeAstro Real Estate Management System 1.0.CVE-2025-5610 · Other software · CodeAstro · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in CodeAstro Real Estate Management System 1.0. Affected by this issue is some unknown functionality of the file /submitpropertydelete.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Real Estate Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Jun 4, 2025A vulnerability classified as critical has been found in CodeAstro Real Estate Management System 1.0.CVE-2025-5583 · Other software · CodeAstro · reported by VulDBMedium 6.9
A vulnerability classified as critical has been found in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /register.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Real Estate Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Jun 4, 2025A vulnerability was found in CodeAstro Real Estate Management System 1.0.CVE-2025-5582 · Other software · CodeAstro · reported by VulDBMedium 5.3
A vulnerability was found in CodeAstro Real Estate Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /profile.php. The manipulation of the argument content leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Real Estate Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Jun 4, 2025A vulnerability was found in CodeAstro Real Estate Management System 1.0.CVE-2025-5581 · Other software · CodeAstro · reported by VulDBMedium 6.9
A vulnerability was found in CodeAstro Real Estate Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/index.php. The manipulation of the argument User leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Real Estate Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Jun 4, 2025A vulnerability was found in CodeAstro Real Estate Management System 1.0.CVE-2025-5580 · Other software · CodeAstro · reported by VulDBMedium 6.9
A vulnerability was found in CodeAstro Real Estate Management System 1.0. It has been classified as critical. This affects an unknown part of the file /login.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Real Estate Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
May 19, 2025Real Estate 7: Incorrect Privilege AssignmentCVE-2025-39459 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Incorrect Privilege Assignment vulnerability in contempoinc Real Estate 7 realestate-7 allows Privilege Escalation.This issue affects Real Estate 7: from n/a through <= 3.5.2.
- Product
- Real Estate 7
- Affected
- up to 3.5.2
- What to do
- Affects up to 3.5.2. Update Real Estate 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2025Real Estate Management System v1.0 was discovered to contain a SQL injection vulnerability via the message parameter at /contact.php.CVE-2023-33770 · Other software · reported by MITREMedium 5.1
Real Estate Management System v1.0 was discovered to contain a SQL injection vulnerability via the message parameter at /contact.php.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 24, 2025Reales WP - Real Estate: Unauthorized modification and loss of dataCVE-2024-13307 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Reales WP - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'reales_delete_file', 'reales_delete_file_plans', 'reales_add_to_favourites', and 'reales_remove_from_favourites' functions in all versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to delete arbitrary attachments, and add or remove favorite property listings for any user.
- Product
- Reales WP - Real Estate
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Reales WP - Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Apr 17, 2025Real Estate Manager: Improper Control of Generation of Code ('Code Injection')CVE-2025-32596 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Improper Control of Generation of Code ('Code Injection') vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows Code Injection.This issue affects Real Estate Manager: from n/a through <= 7.3.
- Product
- Real Estate Manager
- Affected
- up to 7.3
- What to do
- Affects up to 7.3. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025SimplyRETS Real Estate IDX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31011 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ReichertBrothers SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through <= 3.2.2.
- Product
- SimplyRETS Real Estate IDX
- Affected
- up to 3.2.2
- What to do
- Affects up to 3.2.2. Update SimplyRETS Real Estate IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Real Estate Manager: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32668 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows PHP Local File Inclusion.This issue affects Real Estate Manager: from n/a through <= 7.3.
- Product
- Real Estate Manager
- Affected
- up to 7.3
- What to do
- Affects up to 7.3. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Real Estate Manager: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32150 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows PHP Local File Inclusion.This issue affects Real Estate Manager: from n/a through <= 7.3.
- Product
- Real Estate Manager
- Affected
- up to 7.3
- What to do
- Affects up to 7.3. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Contempo Real Estate Core: Stored Cross-Site ScriptingCVE-2025-2906 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Contempo Real Estate Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Contempo Real Estate Core
- Affected
- up to 3.6.3
- What to do
- Affects up to 3.6.3. Update Contempo Real Estate Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcontempothemes.comthemeforest.net
Apr 1, 2025Real Estate 7: Arbitrary file uploadsCVE-2025-2891 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Real Estate 7 WordPress theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'template-submit-listing.php' file in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with Seller-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible if front-end listing submission has been enabled.
- Product
- Real Estate 7
- Affected
- up to 3.5.4
- What to do
- Affects up to 3.5.4. Update Real Estate 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcontempothemes.comwordfence.com
Apr 1, 2025Essential Real Estate: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30849 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in g5theme Essential Real Estate essential-real-estate allows PHP Local File Inclusion.This issue affects Essential Real Estate: from n/a through <= 5.2.0.
- Product
- Essential Real Estate
- Affected
- up to 5.2.0
- What to do
- Affects up to 5.2.0. Update Essential Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2025SimplyRETS Real Estate IDX: Cross-Site Request Forgery (CSRF)CVE-2025-31010 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ReichertBrothers SimplyRETS Real Estate IDX simply-rets allows Cross Site Request Forgery.This issue affects SimplyRETS Real Estate IDX: from n/a through <= 3.0.5.
- Product
- SimplyRETS Real Estate IDX
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update SimplyRETS Real Estate IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0.CVE-2025-2714 · Websites & servers · JoomlaUX · reported by VulDBMedium 5.3
A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /extensions/realestate/index.php/agents/agent-register/addagent. The manipulation of the argument plan_id leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JUX Real Estate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2025A vulnerability was found in Shenzhen Mingyuan Cloud Technology Mingyuan Real Estate ERP System 1.0.CVE-2025-2358 · Other software · Shenzhen Mingyuan Cloud Technology · reported by VulDBMedium 5.3
A vulnerability was found in Shenzhen Mingyuan Cloud Technology Mingyuan Real Estate ERP System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /Kfxt/Service.asmx of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Mingyuan Real Estate ERP System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2025The Realteo - Real Estate Plugin by Purethemes plugin for WordPress, used by the Findeo Theme, is vulnerable to authentication bypass in all versions up to, andCVE-2025-2232 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Realteo - Real Estate Plugin by Purethemes plugin for WordPress, used by the Findeo Theme, is vulnerable to authentication bypass in all versions up to, and including, 1.2.8. This is due to insufficient role restrictions in the 'do_register_user' function. This makes it possible for unauthenticated attackers to register an account with the Administrator role.
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocs.purethemes.networdfence.com
Mar 14, 2025Resido - Real Estate: Unauthorized accessCVE-2025-1285 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Resido - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the delete_api_key and save_api_key AJAX actions in all versions up to, and including, 3.6. This makes it possible for unauthenticated attackers to issue requests to internal services and update API key details.
- Product
- Resido - Real Estate
- Affected
- up to 3.6
- What to do
- Affects up to 3.6. Update Resido - Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Mar 9, 2025A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla.CVE-2025-2127 · Websites & servers · JoomlaUX · reported by VulDBMedium 5.3
A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla. It has been classified as problematic. Affected is an unknown function of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties. The manipulation of the argument Itemid/jp_yearbuilt leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JUX Real Estate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2025A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla and classified as critical.CVE-2025-2126 · Websites & servers · JoomlaUX · reported by VulDBMedium 5.3
A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla and classified as critical. This issue affects some unknown processing of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties of the component GET Parameter Handler. The manipulation of the argument title leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JUX Real Estate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2025WP Real Estate Manager: Authentication BypassCVE-2025-1515 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Real Estate Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.8. This is due to insufficient identity verification on the LinkedIn login request process. This makes it possible for unauthenticated attackers to bypass official authentication and log in as any user on the site, including administrators.
- Product
- WP Real Estate Manager
- Affected
- up to 2.8
- What to do
- Affects up to 2.8. Update WP Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Feb 18, 2025Real Estate Manager: Improper Restriction of Excessive Authentication AttemptsCVE-2025-22645 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows Password Brute Forcing.This issue affects Real Estate Manager: from n/a through <= 7.3.
- Product
- Real Estate Manager
- Affected
- up to 7.3
- What to do
- Affects up to 7.3. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 14, 2025Essential WP Real Estate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23857 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SmartDataSoft Essential WP Real Estate essential-wp-real-estate allows Reflected XSS.This issue affects Essential WP Real Estate: from n/a through <= 1.1.3.
- Product
- Essential WP Real Estate
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Essential WP Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 12, 2025Real Estate 7: Privilege EscalationCVE-2024-13421 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Real Estate 7 WordPress theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.1. This is due to the plugin not properly restricting the roles allowed to be selected during registration. This makes it possible for unauthenticated attackers to register a new administrative user account.
- Product
- Real Estate 7
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update Real Estate 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcontempothemes.comthemeforest.net
Feb 3, 2025Essential WP Real Estate: Does not escape generated URLs before outputting them in attributesCVE-2024-13347 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Essential WP Real Estate WordPress plugin through 1.1.3 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.
- Product
- Essential WP Real Estate
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Essential WP Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Essential Real Estate: Cross-Site Request Forgery (CSRF)CVE-2025-24698 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in g5theme Essential Real Estate essential-real-estate allows Cross Site Request Forgery.This issue affects Essential Real Estate: from n/a through <= 5.1.8.
- Product
- Essential Real Estate
- Affected
- up to 5.1.8
- What to do
- Affects up to 5.1.8. Update Essential Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Easy Real Estate: Incorrect Privilege AssignmentCVE-2024-32555 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in InspiryThemes Easy Real Estate easy-real-estate allows Privilege Escalation.This issue affects Easy Real Estate: from n/a through <= 2.2.9.
- Product
- Easy Real Estate
- Affected
- up to 2.2.9
- What to do
- Affects up to 2.2.9. Update Easy Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 10, 2025Essential WP Real Estate: Unauthorized accessCVE-2024-13318 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Essential WP Real Estate plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the cl_delete_listing_func() function in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated attackers to delete arbitrary pages and posts.
- Product
- Essential WP Real Estate
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Essential WP Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 9, 2025SimplyRETS Real Estate IDX: Stored Cross-Site ScriptingCVE-2024-12491 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SimplyRETS Real Estate IDX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sr_search_form' shortcode in all versions up to, and including, 2.11.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- SimplyRETS Real Estate IDX
- Affected
- up to 2.11.3
- What to do
- Affects up to 2.11.3. Update SimplyRETS Real Estate IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Dec 12, 2024Essential Real Estate: Unauthorized access of dataCVE-2024-12329 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Essential Real Estate plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several pages/post types in all versions up to, and including, 5.1.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to access invoices and transaction logs
- Product
- Essential Real Estate
- Affected
- up to 5.1.6
- What to do
- Affects up to 5.1.6. Update Essential Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 9, 2024Real Estate Directory: Missing AuthorizationCVE-2023-28532 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpdirectorykit.com Real Estate Directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real Estate Directory: from n/a through 1.0.5.
- Product
- Real Estate Directory
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Real Estate Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 10, 2024A vulnerability was found in CodeAstro Real Estate Management System up to 1.0.CVE-2024-11058 · Other software · CodeAstro · reported by VulDBMedium 5.1
A vulnerability was found in CodeAstro Real Estate Management System up to 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /aboutedit.php of the component About Us Page. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Real Estate Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Nov 8, 2024A vulnerability classified as problematic was found in CodeAstro Real Estate Management System 1.0.CVE-2024-11000 · Other software · CodeAstro · reported by VulDBMedium 5.1
A vulnerability classified as problematic was found in CodeAstro Real Estate Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /aboutedit.php of the component About Us Page. The manipulation of the argument aimage leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Real Estate Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Nov 8, 2024A vulnerability classified as problematic has been found in CodeAstro Real Estate Management System 1.0.CVE-2024-10999 · Other software · CodeAstro · reported by VulDBMedium 5.1
A vulnerability classified as problematic has been found in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /aboutadd.php of the component About Us Page. The manipulation of the argument aimage leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Real Estate Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Jun 4, 2024Essential Real Estate: Unauthorized loss of dataCVE-2024-4274 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Essential Real Estate plugin for WordPress is vulnerable to unauthorized loss of data due to insufficient validation on the remove_property_attachment_ajax() function in all versions up to, and including, 4.4.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary attachments.
- Product
- Essential Real Estate
- Affected
- up to 4.4.2
- What to do
- Affects up to 4.4.2. Update Essential Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 4, 2024Essential Real Estate: Stored Cross-Site ScriptingCVE-2024-4273 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Real Estate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ere_property_map' shortcode in all versions up to, and including, 4.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Essential Real Estate
- Affected
- up to 4.4.2
- What to do
- Affects up to 4.4.2. Update Essential Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Feb 12, 2024ERE Recently Viewed – Essential Real Estate Add-On: Deserialization of Untrusted DataCVE-2024-24797 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in G5Theme ERE Recently Viewed – Essential Real Estate Add-On.This issue affects ERE Recently Viewed – Essential Real Estate Add-On: from n/a through 1.3.
- Product
- ERE Recently Viewed – Essential Real Estate Add-On
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update ERE Recently Viewed – Essential Real Estate Add-On to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 31, 2024A vulnerability was found in CodeAstro Real Estate Management System 1.0.CVE-2024-1103 · Other software · CodeAstro · reported by VulDBLow 3.5
A vulnerability was found in CodeAstro Real Estate Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file profile.php of the component Feedback Form. The manipulation of the argument Your Feedback with the input <img src=x onerror=alert(document.cookie)> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252458 is the identifier assigned to this vulnerability.
- Product
- Real Estate Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comvuldb.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.