Vulnerabilities

TI-2025-01959 CVE-2025-2232 · GHSA-cghv-p6j4-5ch6

Realteo - Real Estate Plugin by Purethemes <= 1.2.8 - Authentication Bypass via 'do_register_user'

MEDIUM 50

The Realteo - Real Estate Plugin by Purethemes plugin for WordPress, used by the Findeo Theme, is vulnerable to authentication bypass in all versions up to, and including, 1.2.8.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00552 Published 2025-03-14 No fix listed CWE-269

TI-2021-06530 CVE-2021-24238 · GHSA-828j-hg8h-vf6g

Realteo < 1.2.4 - Arbitrary Property Deletion via IDOR

LOW 31

The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not ensure that the requested property to be deleted belong to the user making the request, allowing any authenticated users to delete arbitrary pr…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01114 Published 2021-04-22 Fixed in 1.2.4, 1.3.1 CWE-284

TI-2021-06529 CVE-2021-24237 · GHSA-fr4g-crj4-v8hc

Realteo < 1.2.4 - Unauthenticated Reflected Cross-Site Scripting (XSS)

LOW 36

The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not properly sanitise the keyword_search, search_radius.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.06275 Published 2021-04-22 Fixed in 1.2.4, 1.3.1 CWE-79

Vulnerabilities

Filters

Realteo - Real Estate Plugin by Purethemes <= 1.2.8 - Authentication Bypass via 'do_register_user'

Realteo < 1.2.4 - Arbitrary Property Deletion via IDOR

Realteo < 1.2.4 - Unauthenticated Reflected Cross-Site Scripting (XSS)