Vulnerabilities

TI-2026-41280 CVE-2026-57343 · GHSA-v47f-fhqp-6ffw

WordPress Real Estate 7 theme <= 3.5.9 - Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 <= 3.5.9 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-07-02 No fix listed CWE-79

TI-2026-41466 CVE-2026-57641 · GHSA-wr7m-w6xj-frxv

WordPress Real Estate 7 theme <= 3.5.9 - Cross Site Request Forgery (CSRF) vulnerability

LOW 28

Unauthenticated Cross Site Request Forgery (CSRF) in Real Estate 7 <= 3.5.9 versions.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00174 Published 2026-06-26 No fix listed CWE-352

TI-2026-39630 CVE-2026-54827 · GHSA-4vhp-x3jq-9qc4

WordPress Real Estate 7 theme <= 3.5.9 - SQL Injection vulnerability

MEDIUM 46

Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.004 Published 2026-06-26 No fix listed CWE-89

TI-2025-26201 CVE-2025-39459 · GHSA-5742-qxvw-5848

WordPress Real Estate 7 theme <= 3.5.2 - Privilege Escalation vulnerability

LOW 38

Incorrect Privilege Assignment vulnerability in contempoinc Real Estate 7 realestate-7 allows Privilege Escalation.This issue affects Real Estate 7: from n/a through <= 3.5.2.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00399 Published 2025-05-19 No fix listed CWE-266

TI-2025-02537 CVE-2025-2906 · GHSA-8jp9-435c-pj3q

Contempo Real Estate Core <= 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

LOW 28

The Contempo Real Estate Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.6.3 due to insufficient input sanitization and output escaping on user su…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0032 Published 2025-04-01 No fix listed CWE-79

TI-2025-02526 CVE-2025-2891 · GHSA-p7hc-668h-v768

WP Pro Real Estate 7 <= 3.5.4 - Authenticated (Custom) Arbitrary File Upload

MEDIUM 41

The Real Estate 7 WordPress theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'template-submit-listing.php' file in all versions up to, and including, 3.5.4.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00739 Published 2025-04-01 No fix listed CWE-434

TI-2024-12462 CVE-2024-13421 · GHSA-5f8c-x4ph-c49p

Real Estate 7 WordPress <= 3.5.1 - Unauthenticated Privilege Escalation to Administrator

MEDIUM 50

The Real Estate 7 WordPress theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00775 Published 2025-02-12 No fix listed CWE-266

TI-2022-23351 CVE-2022-47146 · GHSA-xrpr-pc4j-r3pr

WordPress Real Estate 7 Theme <= 3.3.1 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Contempoinc Real Estate 7 WordPress theme <= 3.3.1 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00382 Published 2023-03-27 No fix listed CWE-79

TI-2021-06679 CVE-2021-24387 · GHSA-4hqq-j7p9-x52j

Real Estate 7 < 3.1.1 - Reflected Cross-Site Scripting (XSS)

LOW 34

The WP Pro Real Estate 7 WordPress theme before 3.1.1 did not properly sanitise the ct_community parameter in its search listing page before outputting it back in it, leading to a reflected Cross-Site Scripting which can…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.03677 Published 2021-07-06 Fixed in 3.1.1 CWE-79

Vulnerabilities

Filters