Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Real Estate Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-23 | 1 | Disclosure1 |
| 2026-04-24 | 1 | PoC1 |
https://atomicedge.io/cve-proof/cve-2026-1845-re-pro-version-1-0-9-medium-vulnerability-proof-of-concept CVE-2026-1845 #WordPress plugin #vulnerability re-pro #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
The post announces a link to a proof‑of‑concept for CVE‑2026‑1845, a medium‑severity vulnerability in a WordPress plugin called re‑pro (v1.0.9).
CVE-2026-1845 The Real Estate Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.9 due to insufficient… https://www.cve.org/CVERecord?id=CVE-2026-1845
Post summary
A CVE detailing a stored cross‑site scripting vulnerability in the Real Estate Pro WordPress plugin, affecting versions up to 1.0.9, is reported with basic technical details but no PoC, exploit, or patch information.