Real Estate 7 WordPress

Real Estate 7 WordPress has 15 disclosed vulnerabilities in the WordSec catalog, reported between 2019 and 2026; all 15 are fixed as of September 2026. Their average CVSS score is 6.9, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 4 high. 2023 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 8 of the records (53%). Other recurring categories include Cross-Site Request Forgery (CSRF), Improper Privilege Management.

Every one of the 15 issues recorded for Real Estate 7 WordPress has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, most of them (9) reported by R3N0.

Strategic Overview

Avg CVSSMedium

6.9/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Real Estate 7 WordPress vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2025-39459

Real Estate 7 <= 3.5.2 - Unauthenticated Privilege Escalation

Read the full analysis

Vulnerability Records

15 records


2026-06-29 00:00	Real Estate 7 WordPress <= 3.5.9 - Unauthenticated Stored Cross-Site Scripting Real Estate 7 WordPress <= 3.5.9	`CVE-2026-57343`	7.2 High	João Pedro S Alcântara (Kinorth)	Yes
2026-06-26 00:00	Real Estate 7 WordPress <= 3.5.9 - Cross-Site Request Forgery Real Estate 7 WordPress <= 3.5.9	`CVE-2026-57641`	4.3 Medium	João Pedro S Alcântara (Kinorth)	Yes
2026-06-17 00:00	Real Estate 7 WordPress <= 3.5.9 - Unauthenticated SQL Injection Real Estate 7 WordPress <= 3.5.9	`CVE-2026-54827`	7.5 High	João Pedro S Alcântara (Kinorth)	Yes
2025-04-17 00:00	Real Estate 7 <= 3.5.2 - Unauthenticated Privilege Escalation Real Estate 7 WordPress <= 3.5.2	`CVE-2025-39459`	9.8 Critical	Ananda Dhakal	Yes
2025-03-31 19:22	WP Pro Real Estate 7 <= 3.5.4 - Authenticated (Custom) Arbitrary File Upload Real Estate 7 WordPress <= 3.5.4	`CVE-2025-2891`	8.8 High	Foxyyy	Yes
2025-02-11 00:00	Real Estate 7 WordPress <= 3.5.1 - Unauthenticated Privilege Escalation to Administrator Real Estate 7 WordPress <= 3.5.1	`CVE-2024-13421`	9.8 Critical	Lucio Sá	Yes
2023-03-09 00:00	Real Estate 7 Theme <= 3.3.4 - Unauthenticated Arbitrary Email Sending Real Estate 7 WordPress <= 3.3.4	`N/A`	5.8 Medium	R3N0	Yes
2023-03-01 00:00	Real Estate 7 <= 3.3.4 - Cross-Site Request Forgery Real Estate 7 WordPress <= 3.3.4	`N/A`	5.4 Medium	R3N0	Yes
2023-02-28 00:00	Real Estate 7 <= 3.3.4 - Reflected Cross-Site Scripting via ct_additional_features Real Estate 7 WordPress <= 3.3.4	`N/A`	6.1 Medium	R3N0	Yes
2023-02-20 00:00	Real Estate 7 Theme <= 3.3.1 - Stored Cross-Site Scripting Real Estate 7 WordPress <= 3.3.1	`CVE-2022-47146`	7.2 High	R3N0	Yes

Showing 1–10 of 15 reports