Vulnerability · Published Jul 6, 2021 · Assigned by WPScan
CVE-2021-24387Real Estate 7 < 3.1.1 - Reflected Cross-Site Scripting (XSS)
Medium 6.1
In plain English
A medium-severity cross-site scripting in WP Pro Real Estate 7 from Contempoinc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.7% (higher than 90% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)3.7%top 10.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
The WP Pro Real Estate 7 WordPress theme before 3.1.1 did not properly sanitise the ct_community parameter in its search listing page before outputting it back in it, leading to a reflected Cross-Site Scripting which can be triggered in both unauthenticated or authenticated user context
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Contempoinc | WP Pro Real Estate 7 | 3.1.1 – before 3.1.1 |
Weakness: CWE-79
References
- https://wpscan.com/vulnerability/27264f30-71d5-4d2b-8f36-4009a2be6745 x_refsource_CONFIRM
- https://contempothemes.com/wp-real-estate-7/changelog/ x_refsource_MISC