CVE-2026-100753

The Joomla Extension - ordasoft.com - Real Estate Manager (Free) is vulnerable to Reflected Cross-Site Scripting (XSS) in versions prior to 6.7.9 . The issue exists on the public property-detail page's "leave a review" form, where the title field repopulates from the request without any escaping ...

EUVD-2026-88435

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager Free element to execute in the browser of anyone who loads the crafted link...

EUVD-2026-88434

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager Free 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries category browsing, search results, and the full property listing from a request-controlled...

CVE-2026-100752

The Joomla Extension - ordasoft.com - Real Estate Manager (Free) version

CVE-2026-57811

CVE-2026-57811 — Realtyna Organic IDX + WPL Real Estate RCE no autenticado -red.svg Ejecución remota de código crítica sin autenticación CVSS 10.0 — Realtyna Organic IDX + WPL Real Estate ≤ 5.2.0 Esta herramienta explota CVE-2026-57811 , una vulnerabilidad crítica en el plugin de WordPress Realty...

CVE-2026-14483

CVE-2026-14483 — WPL Real Estate RCE Ejecución remota de código sin autenticación contra el plugin de WordPress Realtyna WPL Real Estate Listing. Campo| Detalle ---|--- CVE| CVE-2026-14483 Versión afectada| Por defecto, el script solo explota objetivos que ejecutan WPL 5.2.0. Usa --force para...

JoomlaUX JUX Real Estate 3.4.0 - Reflected XSS

A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla. It has been classified as problematic. Affected is an unknown function of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties. The manipulation of the argument Itemid/jpyearbuilt leads to cross...

WordPress Essential Real Estate <3.9.6 - Authenticated Cross-Site Scripting

WordPress Essential Real Estate plugin before 3.9.6 contains an authenticated cross-site scripting vulnerability. The plugin does not sanitize and escape some parameters, which can allow someone with a role as low as admin to inject arbitrary script in the browser of an unsuspecting user in the...

CVE-2025-39459

CVE-2025-39459 Real Estate 7 = 3.5.2 - Escalada de Privilegios No Autenticada 🧨 CVE-2025-39459 — Real Estate 7 = 3.5.2 Escalada de Privilegios No Autenticada 📌 Resumen Este repositorio contiene una herramienta de prueba de concepto en Python para CVE-2025-39459 , que afecta al tema de WordPress...

CVE-2025-39459-Nuclei-Template

📄 Nuclei Template for CVE-2025-39459 🚀 Overview This repository features a Nuclei template specifically designed to detect an Unauthenticated Privilege Escalation Vulnerability CVE-2025-39459 in the Real Estate 7 WordPress Theme. This issue allows unauthenticated attackers to register as...

CVE-2025-39459

CVE-2025-39459 Real Estate 7 = 3.5.2 - Escalada de privilegios sin autenticar 🧨 CVE-2025-39459 — Real Estate 7 = 3.5.2 Escalada de privilegios sin autenticar 📌 Descripción general Este repositorio contiene una herramienta de prueba de concepto en Python para CVE-2025-39459 , que afecta al tema de...

CVE-2026-13714

CVE-2026-13714 Realtyna Organic IDX plugin + WPL Real Estate 5.3.0 - Carga arbitraria de archivos sin autenticar que deriva en ejecución remota de código CVE-2026-13714 — WPL Real Estate RCE sin autenticar Realtyna Organic IDX plugin + WPL Real Estate para WordPress 5.3.0 Carga arbitraria de...

CVE-2026-76790

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting...

EUVD-2026-83501

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting...

CVE-2026-76790 Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting...

CVE-2026-76790: Improper Neutralization of Input During Web Page Generation

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting...

CVE-2026-91014

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into...

CVE-2026-91014

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin versions prior to 5.4.2 are vulnerable to reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain parameters before they are reflected back in the page, specifically via the Loc...

CVE-2026-91014 Realtyna Organic IDX plugin + WPL Real Estate < 5.4.2 - Reflected XSS via Location Selector Endpoint

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into...

CVE-2026-91014 Realtyna Organic IDX plugin + WPL Real Estate < 5.4.2 - Reflected XSS via Location Selector Endpoint

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into...