contempoinc Vulnerabilities and Affected Products
Explore source-attributed vulnerabilities associated with contempoinc products.
Products
- Real Estate 74 vulnerabilities
- Real Estate 7 WordPress3 vulnerabilities
- Contempo Real Estate Core1 vulnerability
- WP Pro Real Estate 71 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-57343HIGH | WordPress Real Estate 7 theme <= 3.5.9 - Cross Site Scripting (XSS) vulnerabilityUnauthenticated Cross Site Scripting (XSS) in Real Estate 7 <= 3.5.9 versions. CWE-79Jul 2, 2026 | CVSS7.1v3.1 | EPSS0.186% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-57641MEDIUM | WordPress Real Estate 7 theme <= 3.5.9 - Cross Site Request Forgery (CSRF) vulnerabilityUnauthenticated Cross Site Request Forgery (CSRF) in Real Estate 7 <= 3.5.9 versions. CWE-352Jun 26, 2026 | CVSS6.5v3.1 | EPSS0.124% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-54827CRITICAL | WordPress Real Estate 7 theme <= 3.5.9 - SQL Injection vulnerabilityUnauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions. CWE-89Jun 26, 2026 | CVSS9.3v3.1 | EPSS0.283% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-39459HIGH | WordPress Real Estate 7 theme <= 3.5.2 - Privilege Escalation vulnerabilityIncorrect Privilege Assignment vulnerability in contempoinc Real Estate 7 realestate-7 allows Privilege Escalation.This issue affects Real Estate 7: from n/a through <= 3.5.2. CWE-266May 19, 2025 | CVSS7.3v3.1 | EPSS0.359% | PoCs3 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-2906MEDIUM | Contempo Real Estate Core <= 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeThe Contempo Real Estate Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CWE-79Apr 1, 2025 | CVSS6.4v3.1 | EPSS0.296% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-2891HIGH | WP Pro Real Estate 7 <= 3.5.4 - Authenticated (Custom) Arbitrary File UploadThe Real Estate 7 WordPress theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'template-submit-listing.php' file in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with Seller-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible if front-end listing submission has been enabled. CWE-434Apr 1, 2025 | CVSS8.8v3.1 | EPSS0.676% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-13421CRITICAL | Real Estate 7 WordPress <= 3.5.1 - Unauthenticated Privilege Escalation to AdministratorThe Real Estate 7 WordPress theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.1. This is due to the plugin not properly restricting the roles allowed to be selected during registration. This makes it possible for unauthenticated attackers to register a new administrative user account. CWE-266Feb 12, 2025 | CVSS9.8v3.1 | EPSS0.747% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-47146HIGH | WordPress Real Estate 7 Theme <= 3.3.1 is vulnerable to Cross Site Scripting (XSS)Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Contempoinc Real Estate 7 WordPress theme <= 3.3.1 versions. CWE-79Mar 27, 2023 | CVSS7.1v3.1 | EPSS0.382% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-24387MEDIUM | Real Estate 7 < 3.1.1 - Reflected Cross-Site Scripting (XSS)The WP Pro Real Estate 7 WordPress theme before 3.1.1 did not properly sanitise the ct_community parameter in its search listing page before outputting it back in it, leading to a reflected Cross-Site Scripting which can be triggered in both unauthenticated or authenticated user context | CVSS6.1v3.1 | EPSS3.68% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |