CVE-2022-3933

MEDIUM NUCLEI

Essential Real Estate < 3.9.6 - Authenticated Stored Cross-Site Scripting

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2022-3933 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

The Essential Real Estate WordPress plugin before 3.9.6 does not sanitize and escapes some parameters, which could allow users with a role as low as Admin to perform Cross-Site Scripting attacks.

Nuclei Templates (1)

WordPress Essential Real Estate <3.9.6 - Authenticated Cross-Site Scripting
MEDIUMVERIFIEDby r3Y3r53

References (1)

Core 1
Core References
Exploit, Third Party Advisory exploit vdb-entry technical-description
https://wpscan.com/vulnerability/6395f3f1-5cdf-4c55-920c-accc0201baf4

Scores

CVSS v3 5.4
EPSS 0.0087
EPSS Percentile 54.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

Status published
Products (1)
g5theme/essential_real_estate < 3.9.6
Published Dec 12, 2022
Tracked Since Feb 18, 2026