EIP-2026-114347

The exploit demonstrates a persistent XSS vulnerability in the Real Estate 7 WordPress theme (v2.8.9 and below) by injecting malicious JavaScript into the 'Virtual Tour Embed' field during listing submission. The payload executes when the listing is viewed, potentially allowing cookie theft or other client-side attacks.