CVE-2026-57343

9th percentile — higher than 9% of all known CVEs

Real Estate 7 plugin version 3.5.9 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without requiring authentication.

Risk includes user session theft, redirection to malicious sites, and theft of sensitive data. The attack can be performed by any visitor to the website.

Immediately update the Real Estate 7 plugin to version 3.6.0 or later. In the meantime, apply temporary WAF rules to block suspicious input parameters.