CVE-2026-96667

Name of the Vulnerable Software and Affected Versions Real Estate Manager – Property Listing and Agent Management versions prior to 7.4

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. This is achieved via the first name parameter. Additionally, the reCAPTCHA check can be bypassed by omitting the g-recaptcha-response parameter, as validation only occurs if the parameter is present.

Recommendations Update the plugin to version 7.4 or later. As a temporary mitigation, restrict or sanitize inputs for the first name parameter.