6.8
Medium
CVE-2024-13347 The Essential WP Real Estate WordPress plugin through 1.1.3 does not escape generated URLs before outputting them in…
Description
The Essential WP Real Estate WordPress plugin through 1.1.3 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Essential WP Real Estate 1.1 | earliest → 1.1.3 | No fix stated |