CVE-2026-93908 in Real Estate Manager Plugin
Summary
by MITRE • 09/30/2026
The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_price_text' parameter in all versions up to, and including, 7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is further enabled by the absence of any capability, nonce, or ownership check on the wp_ajax_rem_create_pro_ajax handler, and because the value is persisted via update_post_meta rather than post_content, the wp_kses filtering tied to the unfiltered_html capability does not apply.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The Real Estate Manager plugin for WordPress contains a critical security flaw identified as Stored Cross-Site Scripting within its property listing functionality. This vulnerability affects all versions up to and including 7.3 and stems from insufficient input sanitization and output escaping mechanisms when handling the before_price_text parameter. The core technical issue lies in how the application processes user-supplied data for this specific field, failing to properly validate or encode special characters that could be interpreted as executable code by a web browser. This lack of rigorous validation allows malicious actors to inject arbitrary JavaScript payloads into the database through legitimate administrative interfaces provided by the plugin.
The operational impact is significantly amplified by architectural oversights in the underlying WordPress AJAX handler responsible for processing these updates, specifically wp_ajax_rem_create_pro_ajax. The absence of capability checks ensures that any user with subscriber-level access or higher can trigger this endpoint without restriction. Furthermore, the lack of nonce verification means that Cross-Site Request Forgery protections are effectively bypassed, allowing attackers to craft malicious requests from external sources if they can trick an authenticated victim into loading them. This combination of weak authentication controls and missing request validation creates a low-barrier entry point for exploitation by even minimally privileged users within the WordPress ecosystem.
A critical factor enabling this vulnerability is the method used to persist data, which utilizes update_post_meta rather than writing directly to post_content. In standard WordPress operations, content written to post_content is typically filtered through wp_kses when the user possesses the unfiltered_html capability, providing a layer of protection against script injection. However, because metadata stored via update_post_meta bypasses this specific filtering mechanism, attackers can inject scripts that would otherwise be stripped out in other contexts. This architectural nuance effectively neutralizes one of WordPress's primary defense-in-depth strategies for content handling, leaving the application exposed to persistent attacks that survive database queries and are rendered directly into web pages upon access.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The stored nature of the attack means it persists in the application's data store, affecting all subsequent users who view the compromised property listings rather than just the attacker themselves. In terms of adversary tactics, this behavior maps to ATT&CK technique T1059, specifically sub-technique 007 for JavaScript execution, and falls under the initial access or persistence phases depending on whether the injected script is used to steal session cookies or maintain a foothold within the application environment. The exploitation requires authenticated access but leverages low-level privileges, highlighting risks associated with overly permissive role-based access controls in WordPress plugins.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Users should immediately update the Real Estate Manager plugin to version 7.4 or later where these issues have been resolved by developers implementing proper sanitization functions like sanitize_text_field for input and esc_html or wp_kses_post for output escaping. For organizations unable to patch instantly, restricting user roles that can access property management features is a viable temporary countermeasure. Additionally, enforcing strict Content Security Policy headers on the web server can help mitigate the impact of any successfully injected scripts by preventing unauthorized script execution from external domains. Regular security audits focusing on AJAX handlers and metadata handling practices are recommended to prevent similar vulnerabilities in future development cycles.