CVE-2021-24237CWE-79

CVE-2021-24237: fallo en PureThemes Realteo

Realteo < 1.2.4 - Unauthenticated Reflected Cross-Site Scripting (XSS)

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Realteo+ Monitorear Findeo

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

18Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendepss 6.3%
The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not properly sanitise the keyword_search, search_radius. _bedrooms and _bathrooms GET parameters before outputting them in its properties page, leading to an unauthenticated reflected Cross-Site Scripting issue.
Productos afectados
PureThemes · FindeoPureThemes · Realteo
CVEs relacionadas — PureThemes Realteo

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-24238—Realteo < 1.2.4 - Arbitrary Property Deletion via IDOREPSS 1.1%CVE-2025-2232CRITICALRealteo - Real Estate Plugin by Purethemes <= 1.2.8 - Authentication Bypass via 'do_register_user'EPSS 0.6%