CVE-2025-2906: 
WordPress vulnerability analysis and mitigation

The Contempo Real Estate Core plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2025-2906) discovered in versions up to and including 3.6.3. The vulnerability was disclosed on April 1, 2025, and affects the plugin's shortcode functionality (NVD, CVE).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in shortcodes. This security flaw has been assigned a CVSS v3.1 Base Score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized data access or manipulation of user sessions (NVD).

Users should update their Contempo Real Estate Core plugin to a version newer than 3.6.3 once available. The vulnerability has been reported and documented in the changelog (Contempo Changelog).