CVE-2026-93908

Name of the Vulnerable Software and Affected Versions Real Estate Manager – Property Listing and Agent Management versions prior to 7.4

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts into pages. This is possible because the wp ajax rem create pro ajax handler lacks capability, nonce, or ownership checks. Additionally, since the value is persisted via update post meta instead of post content, the wp kses filtering—a function used to sanitize HTML—tied to the unfiltered html capability is not applied. The issue is triggered via the before price text parameter.

Recommendations Update the plugin to version 7.4 or later. As a temporary mitigation, restrict access to the before price text parameter in the wp ajax rem create pro ajax handler.