WordPress Plugin Vulnerabilities

Essential Real Estate < 3.9.6 - Reflected Cross-Site-Scripting

Description

The plugin does not sanitize and escapes some parameters, which could allow users with a role as low as Admin to perform Cross-Site Scripting attacks.

Proof of Concept

Affects Plugins

Plugin icon
essential-real-estate
Fixed in 3.9.6

References

CVE
CVE-2022-3933

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
cydave
Submitter
cydave
Submitter website
https://cyllective.com/
Submitter twitter
cyllective
Verified
Yes
WPVDB ID
6395f3f1-5cdf-4c55-920c-accc0201baf4

Timeline

Publicly Published
2022-11-17 (about 3 years ago)
Added
2022-11-17 (about 3 years ago)
Last Updated
2022-11-24 (about 3 years ago)

Other

Published
Title
Published
2024-06-22
Title
RafflePress Lite < 1.12.14 - Editor+ Stored XSS
Published
2024-09-27
Title
WP Mail Catcher < 2.1.10 - Reflected Cross-Site Scripting
Published
2025-01-16
Title
LawPress – Law Firm Website Management <= 1.4.5 - Reflected Cross-Site Scripting
Published
2018-05-14
Title
WP ULike <= 3.1 - Unauthenticated Stored XSS
Published
2025-04-10
Title
Credova_Financial < 2.4.9 - Reflected Cross-Site Scripting