CVE-2025-6190

The Realty Portal – Agent plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the rpuserprofile AJAX handler in versions 0.1.0 through 0.3.9. The handler reads the client-supplied meta key and value pairs from $POST and passes them directly to...

CVE-2025-6190 Realty Portal – Agent <= 0.3.9 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via rp_user_profile() Function

The Realty Portal – Agent plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the rpuserprofile AJAX handler in versions 0.1.0 through 0.3.9. The handler reads the client-supplied meta key and value pairs from $POST and passes them directly to...

CVE-2025-6190 Realty Portal – Agent <= 0.3.9 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via rp_user_profile() Function

The Realty Portal – Agent plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the rpuserprofile AJAX handler in versions 0.1.0 through 0.3.9. The handler reads the client-supplied meta key and value pairs from $POST and passes them directly to...

CVE-2025-6190

CVE-2025-6190 describes a privilege-escalation flaw in the Realty Portal – Agent WordPress plugin (versions 0.1.0–0.3.9). The rp_user_profile() AJAX handler reads client-supplied POST data and passes it to update_user_meta() without restricting to a whitelist, enabling authenticated users with Su...

PT-2025-30513 · WordPress · Realty Portal – Agent

Name of the Vulnerable Software and Affected Versions: Realty Portal – Agent plugin for WordPress versions 0.1.0 through 0.3.9 Description: The Realty Portal – Agent plugin for WordPress is vulnerable to privilege escalation due to missing authorization within the rp user profile AJAX handler. Th...

WordPress plugin Realty Portal – Agent 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-51786

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bestweblayout Realty by BestWebSoft realty allows Stored XSS.This issue affects Realty by BestWebSoft: from n/a through = 1.1.5...

CVE-2022-1691

The Realty Workstation WordPress plugin before 1.0.15 does not sanitise and escape the transedit parameter before using it in a SQL statement when an agent edit a transaction, leading to an SQL injection...

CVE-2012-4279

Multiple SQL injection vulnerabilities in Free Realty 3.1-0.6 allow remote attackers to execute arbitrary SQL commands via the 1 view parameter to agentdisplay.php or 2 edit parameter to admin/admin.php...

CVE-2012-4280

Multiple cross-site request forgery CSRF vulnerabilities in admin/agenteditor.php in Free Realty 3.1-0.6 allow remote attackers to hijack the authentication of administrators for requests that 1 add an agent via an addagent action or 2 modify an agent...

CVE-2012-4278

Multiple cross-site scripting XSS vulnerabilities in Free Realty 3.1-0.6 allow remote attackers to inject arbitrary web script or HTML via the 1 notes parameter to a admin/agenteditor.php; 2 title, 3 previewdesc, 4 fulldesc, or 5 notes parameter b to agentadmin.php or c in an addlisting action to...

CVE-2012-6584

Multiple SQL injection vulnerabilities in MYRE Realty Manager allow remote attackers to execute arbitrary SQL commands via the bathrooms1 parameter to 1 demo2/search.php or 2 search.php...

CVE-2012-6585

Cross-site scripting XSS vulnerability in search.php in MYRE Realty Manager allows remote attackers to inject arbitrary web script or HTML via the catid1 parameter...

CVE-2025-23477

Missing Authorization vulnerability in realtyworkstation Realty Workstation realty-workstation allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Realty Workstation: from n/a through = 1.0.45...

CVE-2024-50489

Authentication Bypass Using an Alternate Path or Channel vulnerability in realtyworkstation Realty Workstation realty-workstation allows Authentication Bypass.This issue affects Realty Workstation: from n/a through = 1.0.45...

CVE-2025-23477

Missing Authorization vulnerability in realtyworkstation Realty Workstation realty-workstation allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Realty Workstation: from n/a through = 1.0.45...

CVE-2025-23477

The CVE-2025-23477 entry describes a Missing Authorization vulnerability in Realty Workstation that affects Realty Workstation versions from n/a up to 1.0.45. The issue allows accessing functionality Not Properly Constrained by ACLs, which is a high-severity exposure (CVSS 3.1: 8.2, HIGH) with ne...

CVE-2025-23477 WordPress Realty Workstation plugin <= 1.0.45 - Broken Access Control vulnerability

Missing Authorization vulnerability in Realty Workstation Realty Workstation allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Realty Workstation: from n/a through 1.0.45...

CVE-2025-23477 WordPress Realty Workstation plugin <= 1.0.45 - Broken Access Control vulnerability

Missing Authorization vulnerability in realtyworkstation Realty Workstation realty-workstation allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Realty Workstation: from n/a through = 1.0.45...

WordPress plugin Realty Workstation 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...