Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-18532: Realty plugin for WordPress can let attackers run scripts

CVE-2017-18532 · published 7 years ago

Summary

Versions of the Realty plugin for WordPress earlier than 1.1.0 let a malicious user place hidden code on your site. That code can run in visitors' browsers, potentially stealing information or altering what they see. Update the plugin to version 1.1.0 or later as soon as possible to close the gap.

What to do

Update bestwebsoft realty to version 1.1.0 or later.

Affected software

Vendor	Product	Affected versions
bestwebsoft	realty	< 1.1.0 `cpe:2.3:a:bestwebsoft:realty::::::wordpress::*`

Original advisory text

The realty plugin before 1.1.0 for WordPress has multiple XSS issues.

References

https://wordpress.org/plugins/realty/#developers Release Notes

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.1 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published20 Aug 2019

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2017-18532 · NVD

Track software like this

Free during beta