VulnTitan VulnTitan Security command center
Theme Vulnerability Hub
Theme 12 known issues Latest disclosed Apr 17, 2025

Real Estate 7 WordPress Vulnerabilities

Review known vulnerability records for the WordPress theme Real Estate 7 WordPress (`realestate-7`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2025-39459, CVE-2025-2891 and CVE-2024-13421, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
12
High or Critical
4
Patch Coverage
100%
Last Updated
Apr 22, 2025
Priority CVE Quick Links

Fast paths into Real Estate 7 WordPress CVE reports

Start with the highest-signal CVE records for this WordPress theme before scanning the full vulnerability feed.

Indexed CVEs
5
CVE-2025-39459 Critical 3.5.3
CVE-2025-39459 Real Estate 7 WordPress Privilege Escalation

Real Estate 7 <= 3.5.2 - Unauthenticated Privilege Escalation

CVE-2024-13421 Critical 3.5.2
CVE-2024-13421 Real Estate 7 WordPress Privilege Escalation

Real Estate 7 WordPress <= 3.5.1 - Unauthenticated Privilege Escalation to Administrator

CVE-2025-2891 High 3.5.5
CVE-2025-2891 Real Estate 7 WordPress Remote Code Execution

WP Pro Real Estate 7 <= 3.5.4 - Authenticated (Custom) Arbitrary File Upload

CVE-2022-47146 High 3.3.2
CVE-2022-47146 Real Estate 7 WordPress Stored Cross-Site Scripting

Real Estate 7 Theme <= 3.3.1 - Stored Cross-Site Scripting

CVE-2021-24387 Medium 3.1.1
CVE-2021-24387 Real Estate 7 WordPress Cross-Site Scripting

WP Pro Real Estate 7 < 3.1.1 - Reflected Cross-Site Scripting

Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for Real Estate 7 WordPress so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
12 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
2 critical and 2 high severity findings.
Recent CVEs
CVE-2025-39459, CVE-2025-2891 and CVE-2024-13421
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for Real Estate 7 WordPress

Sorted by latest disclosure date so newly published issues surface first.

Theme Critical Patched: Yes CVE-2025-39459
CVE-2025-39459: Real Estate 7 <= 3.5.2 - Unauthenticated Privilege Escalation

The Real Estate 7 WordPress theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.2. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.

Published
Apr 17, 2025
Patched Release
3.5.3
Affected Versions
Versions up to 3.5.2
Next Step
Update to 3.5.3 or newer if supported.
Open CVE-2025-39459 Report Open CVE Reference
Theme High Patched: Yes CVE-2025-2891
CVE-2025-2891: WP Pro Real Estate 7 <= 3.5.4 - Authenticated (Custom) Arbitrary File Upload

The Real Estate 7 WordPress theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'template-submit-listing.php' file in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with Seller-leve...

Published
Mar 31, 2025
Patched Release
3.5.5
Affected Versions
Versions up to 3.5.4
Next Step
Update to 3.5.5 or newer if supported.
Open CVE-2025-2891 Report Open CVE Reference
Theme Critical Patched: Yes CVE-2024-13421
CVE-2024-13421: Real Estate 7 WordPress <= 3.5.1 - Unauthenticated Privilege Escalation to Administrator

The Real Estate 7 WordPress theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.1. This is due to the plugin not properly restricting the roles allowed to be selected during registration. This makes it possible for unauthenticated a...

Published
Feb 11, 2025
Patched Release
3.5.2
Affected Versions
Versions up to 3.5.1
Next Step
Update to 3.5.2 or newer if supported.
Open CVE-2024-13421 Report Open CVE Reference
Theme Medium Patched: Yes
Real Estate 7 Theme <= 3.3.4 - Unauthenticated Arbitrary Email Sending

The Real Estate 7 Theme for WordPress suffers from an Open Mailer vulnerability in versions up to, and including, 3.3.4. This is due to a lack of authorization in the /includes/ajax-submit-favorites.php and /includes/ajax-submit-listings.php files which are reachable via AJAX cal...

Published
Mar 09, 2023
Patched Release
3.3.5
Affected Versions
Versions up to 3.3.4
Next Step
Update to 3.3.5 or newer if supported.
Open Full Report
Theme Medium Patched: Yes
Real Estate 7 <= 3.3.4 - Cross-Site Request Forgery

The Real Estate 7 theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.4. This is due to missing or incorrect nonce validation on several of its AJAX actions. This makes it possible for unauthenticated attackers to invoke those fun...

Published
Mar 01, 2023
Patched Release
3.3.5
Affected Versions
Versions up to 3.3.4
Next Step
Update to 3.3.5 or newer if supported.
Open Full Report
Theme Medium Patched: Yes
Real Estate 7 <= 3.3.4 - Reflected Cross-Site Scripting via ct_additional_features

The Real Estate 7 Theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ct_additional_features’ parameter in versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker...

Published
Feb 28, 2023
Patched Release
3.3.5
Affected Versions
Versions up to 3.3.4
Next Step
Update to 3.3.5 or newer if supported.
Open Full Report
Theme High Patched: Yes CVE-2022-47146
CVE-2022-47146: Real Estate 7 Theme <= 3.3.1 - Stored Cross-Site Scripting

The Real Estate 7 Theme for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 3.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

Published
Feb 20, 2023
Patched Release
3.3.2
Affected Versions
Versions up to 3.3.1
Next Step
Update to 3.3.2 or newer if supported.
Open CVE-2022-47146 Report Open CVE Reference
Theme Medium Patched: Yes CVE-2021-24387
CVE-2021-24387: WP Pro Real Estate 7 < 3.1.1 - Reflected Cross-Site Scripting

The WP Pro Real Estate 7 WordPress theme before 3.1.1 did not properly sanitise the ct_community parameter in its search listing page before outputting it back in it, leading to a reflected Cross-Site Scripting which can be triggered in both unauthenticated or authenticated user...

Published
Jun 10, 2021
Patched Release
3.1.1
Affected Versions
Versions before 3.1.1
Next Step
Update to 3.1.1 or newer if supported.
Open CVE-2021-24387 Report Open CVE Reference
Theme Medium Patched: Yes
Real Estate 7 WordPress < 3.0.6 - Reflected Cross-Site Scripting

The Real Estate 7 Theme for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters (ct_sqft_from, ct_sqft_to, ct_lotsize_from, ct_lotsize_to, & ct_mls) in versions before 3.0.6 due to insufficient input sanitization and output escaping. This makes it pos...

Published
Aug 29, 2020
Patched Release
3.0.6
Affected Versions
Versions up to 3.0.5
Next Step
Update to 3.0.6 or newer if supported.
Open Full Report
Theme Medium Patched: Yes
Real Estate 7 <= 3.0.3 - Reflected Cross-Site Scripting

The Real Estate 7 theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ct_keyword’ parameter in versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

Published
Jul 23, 2020
Patched Release
3.0.4
Affected Versions
Versions up to 3.0.3
Next Step
Update to 3.0.4 or newer if supported.
Open Full Report
Theme Medium Patched: Yes
Real Estate 7 WordPress < 2.9.5 - Multiple Vulnerabilities

The Real Estate 7 WordPress theme for WordPress is vulnerable to both Reflected and Stored Cross-Site Scripting, Insecure Direct Object Reference, and Sensitive Information Exposure in versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping...

Published
Jan 14, 2020
Patched Release
2.9.5
Affected Versions
Versions before 2.9.5
Next Step
Update to 2.9.5 or newer if supported.
Open Full Report
Theme Medium Patched: Yes
Real Estate 7 WordPress Theme < 2.9.1 - Stored Cross-Site Scripting

The Real Estate 7 WordPress Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the template-edit-listing.php and template-submit-listing.php php files in versions up to, and including, 2.9.0 due to insufficient input sanitization and output escaping. This makes...

Published
Jul 20, 2019
Patched Release
2.9.1
Affected Versions
Versions before 2.9.1
Next Step
Update to 2.9.1 or newer if supported.
Open Full Report