TI-2026-70341 Aliases CVE-2026-42632 GHSA-qx3r-f8g8-rqv9

Cross-site scripting in WordPress Qode Real Estate plugin

LOW 30CWE-79Published 2026-10-10 · Updated 2026-10-11

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

The Qode Real Estate plugin for WordPress is affected up to and including version 1.1.7.3. Improper input neutralization lets injected script run in generated web pages (CWE-79). An unauthenticated remote attacker can exploit this if a user interacts with the affected page, with low impact on confidentiality, integrity and availability.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00175 7th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Mikado-Themes	Qode Real Estate	up to 1.1.7.3	—	No fix listed	CNA

Qode Real Estate VendorMikado-Themes Affected up to 1.1.7.3 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Qode Real Estate.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

2026-10-11 Threatist record created from CVE-2026-42632
2026-10-11 Alias added: GHSA-qx3r-f8g8-rqv9

References

Other 1

https://patchstack.com/database/wordpress/plugin/qode-real-estate/vulnerability/wordpress-qode-real-estate-plugin-1-1-7-3-cross-site-scripting-xss-vulnerability?_s_id=cve

TI-2025-01400 Qi Blocks < 1.4 - Contributor+ Stored XSS via ToC Block CVSS 3.1MEDIUM 5.4
TI-2025-01399 Qi Blocks < 1.4 - Contributor+ Stored XSS vi Countdown Block CVSS 3.1MEDIUM 5.4
TI-2025-01398 Qi Blocks < 1.4 - Contributor+ Stored XSS via Counter Block CVSS 3.1MEDIUM 5.4
TI-2024-11397 Biagiotti Membership <= 1.0.2 - Authentication Bypass via biagiotti_membership_check_facebook_user CVSS 3.1CRITICAL 9.8
TI-2025-12371 Tiare Membership <= 1.2 - Unauthenticated Privilege Escalation CVSS 3.1CRITICAL 9.8
TI-2026-46716 WordPress Qode Tours plugin <= 3.1.3.1 - SQL Injection vulnerability CVSS 3.1CRITICAL 9.3

See all 123 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences