WordPress Real Estate Manager Pro plugin <= 12.8.6 - Authenticated (Subscriber+) Privilege Escalation via 'user_has_cap' Filter ID Collision vulnerability

Authenticated Subscriber+ Privilege Escalation via 'userhascap' Filter ID Collision vulnerability discovered by 0xd4rk5id3 - EnvoraSec in WordPress Plugin Real Estate Manager Pro versions = 12.8.6...

CVE-2026-15142

The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is due to improper capability handling in the allowattachmentactions function, which can treat a target user ID as a media attachment ID during user capability...

CVE-2026-15142 Real Estate Manager Pro <= 12.8.6 - Authenticated (Subscriber+) Privilege Escalation via 'user_has_cap' Filter ID Collision

The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is due to improper capability handling in the allowattachmentactions function, which can treat a target user ID as a media attachment ID during user capability...

CVE-2026-15142

The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is due to improper capability handling in the allowattachmentactions function, which can treat a target user ID as a media attachment ID during user capability...

CVE-2026-15142

The CVE-2026-15142 entry documents a Privilege Escalation vulnerability in the WordPress plugin Real Estate Manager Pro up to version 12.8.6, caused by improper capability handling in the allow_attachment_actions() function. An authenticated user with Subscriber-level access or higher can escalat...

CVE-2026-15142 Real Estate Manager Pro <= 12.8.6 - Authenticated (Subscriber+) Privilege Escalation via 'user_has_cap' Filter ID Collision

The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is due to improper capability handling in the allowattachmentactions function, which can treat a target user ID as a media attachment ID during user capability...

EUVD-2026-59597

The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is due to improper capability handling in the allowattachmentactions function, which can treat a target user ID as a media attachment ID during user capability...

PT-2026-72879

Name of the Vulnerable Software and Affected Versions Real Estate Manager Pro versions prior to 12.8.7 Description Improper capability handling in the allow attachment actions function allows authenticated attackers with Subscriber-level access or higher to escalate their privileges to...

CVE-2026-15142: Improper Privilege Management

The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is due to improper capability handling in the allowattachmentactions function, which can treat a target user ID as a media attachment ID during user capability...

CVE-2026-57701

Unauthenticated Cross Site Scripting XSS in Real Estate Manager Pro = 12.8.5 versions...

EUVD-2026-48173

Unauthenticated Cross Site Scripting XSS in Real Estate Manager Pro = 12.8.5 versions...

CVE-2026-57701 WordPress Real Estate Manager Pro plugin <= 12.8.5 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Real Estate Manager Pro = 12.8.5 versions...

CVE-2026-57701: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Real Estate Manager Pro = 12.8.5 versions...

CVE-2026-57398

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WebCodingPlace Real Estate Manager Pro real-estate-manager-pro allows Reflected XSS.This issue affects Real Estate Manager Pro: from n/a through = 12.8.3...

CVE-2026-57398 WordPress Real Estate Manager Pro plugin <= 12.8.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WebCodingPlace Real Estate Manager Pro real-estate-manager-pro allows Reflected XSS.This issue affects Real Estate Manager Pro: from n/a through = 12.8.3...

CVE-2026-57398: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WebCodingPlace Real Estate Manager Pro real-estate-manager-pro allows Reflected XSS.This issue affects Real Estate Manager Pro: from n/a through = 12.8.3...

CVE-2025-54032 WordPress Real Estate Manager Pro Plugin <= 12.7.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WebCodingPlace Real Estate Manager Pro allows Reflected XSS. This issue affects Real Estate Manager Pro: from n/a through 12.7.3...

CVE-2025-54032: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WebCodingPlace Real Estate Manager Pro real-estate-manager-pro allows Reflected XSS.This issue affects Real Estate Manager Pro: from n/a through = 12.7.3...

WordPress plugin Real Estate Manager Pro 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin.... A security vulnerability...