CVE-2021-24237CWE-79

CVE-2021-24237: vulnerability in PureThemes Realteo

Realteo < 1.2.4 - Unauthenticated Reflected Cross-Site Scripting (XSS)

Published · Updated

Follow this CVE+ Monitor Realteo+ Monitor Findeo

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

18Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 6.3%
The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not properly sanitise the keyword_search, search_radius. _bedrooms and _bathrooms GET parameters before outputting them in its properties page, leading to an unauthenticated reflected Cross-Site Scripting issue.
Affected products
PureThemes · FindeoPureThemes · Realteo
Related CVEs — PureThemes Realteo

In the same product, most dangerous first.

CVE-2021-24238—Realteo < 1.2.4 - Arbitrary Property Deletion via IDOREPSS 1.1%CVE-2025-2232CRITICALRealteo - Real Estate Plugin by Purethemes <= 1.2.8 - Authentication Bypass via 'do_register_user'EPSS 0.6%