theme
45 known security issues reported for the Realestate 7 WordPress theme. Most recent disclosed Jun 29, 2026.
Running Realestate 7 on your site? Check whether your installed version is affected.
Scan your site freeThe Real Estate 7 WordPress theme for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user...
The Real Estate 7 WordPress theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.9. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted the...
The Real Estate 7 WordPress theme for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL q...
[en] Incorrect Privilege Assignment vulnerability in Contempo Themes Real Estate 7 allows Privilege Escalation.This issue affects Real Estate 7: from n/a through 3.5.2.
The Real Estate 7 WordPress theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.2. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.
The Real Estate 7 WordPress theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'template-submit-listing.php' file in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with Seller-level access and above, to upload arbitrary...
[en] The Real Estate 7 WordPress theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.1. This is due to the plugin not properly restricting the roles allowed to be selected during registration. This makes it possible for unauthenticated attackers to register a new administ...
The Real Estate 7 WordPress theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.1. This is due to the plugin not properly restricting the roles allowed to be selected during registration. This makes it possible for unauthenticated attackers to register a new administrativ...
[en] Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Contempoinc Real Estate 7 WordPress theme <= 3.3.1 versions.
Update the WordPress Real Estate 7 theme to the latest available version (at least 3.3.5). FearZzZz discovered and reported this Broken Access Control vulnerability in WordPress Real Estate 7 Theme. This vulnerability has been fixed in version 3.3.5.
The Real Estate 7 Theme for WordPress suffers from an Open Mailer vulnerability in versions up to, and including, 3.3.4. This is due to a lack of authorization in the /includes/ajax-submit-favorites.php and /includes/ajax-submit-listings.php files which are reachable via AJAX call but also directly via POST. This makes...
The Real Estate 7 Theme for WordPress suffers from an Open Mailer vulnerability in versions up to, and including, 3.3.4. This is due to a lack of authorization in the /includes/ajax-submit-favorites.php and /includes/ajax-submit-listings.php files which are reachable via AJAX call but also directly via POST. This makes...
Update the WordPress Real Estate 7 theme to the latest available version (at least 3.3.5). FearZzZz discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Real Estate 7 Theme. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their c...
Update the WordPress Real Estate 7 theme to the latest available version (at least 3.3.5). FearZzZz discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Real Estate 7 Theme. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML pa...
The Real Estate 7 theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.4. This is due to missing or incorrect nonce validation on several of its AJAX actions. This makes it possible for unauthenticated attackers to invoke those functions via a forged request granted they...
The Real Estate 7 theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.4. This is due to missing or incorrect nonce validation on several of its AJAX actions. This makes it possible for unauthenticated attackers to invoke those functions via a forged request granted they...
The Real Estate 7 Theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ct_additional_features’ parameter in versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...
The Real Estate 7 Theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ct_additional_features’ parameter in versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...
The Real Estate 7 Theme for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 3.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...
[en] The WP Pro Real Estate 7 WordPress theme before 3.1.1 did not properly sanitise the ct_community parameter in its search listing page before outputting it back in it, leading to a reflected Cross-Site Scripting which can be triggered in both unauthenticated or authenticated user context
The WP Pro Real Estate 7 WordPress theme before 3.1.1 did not properly sanitise the ct_community parameter in its search listing page before outputting it back in it, leading to a reflected Cross-Site Scripting which can be triggered in both unauthenticated or authenticated user context.
Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered by m0ze (Patchstack Red Team) in WordPress Real Estate 7 premium theme (versions <= 3.1.0). Vulnerable parameter: "&ct_community=".
Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability found by Ex.Mi in WordPress Real Estate 7 premium theme (versions <= 3.0.4).
The Real Estate 7 Theme for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters (ct_sqft_from, ct_sqft_to, ct_lotsize_from, ct_lotsize_to, & ct_mls) in versions before 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to i...
The Real Estate 7 Theme for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters (ct_sqft_from, ct_sqft_to, ct_lotsize_from, ct_lotsize_to, & ct_mls) in versions before 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to i...
The Real Estate 7 theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ct_keyword’ parameter in versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that exec...
Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered by m0ze in WordPress Real Estate 7 premium theme (versions <= 3.0.3).
The Real Estate 7 theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ct_keyword’ parameter in versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that exec...
The Real Estate 7 WordPress theme for WordPress is vulnerable to both Reflected and Stored Cross-Site Scripting, Insecure Direct Object Reference, and Sensitive Information Exposure in versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping, along with exposure of email addresses...
Unauthenticated Cross-Site Scripting (XSS) vulnerability discovered by m0ze in WordPress Real Estate 7 premium theme (versions <= 2.9.4).
The Real Estate 7 WordPress theme for WordPress is vulnerable to both Reflected and Stored Cross-Site Scripting, Insecure Direct Object Reference, and Sensitive Information Exposure in versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping, along with exposure of email addresses...
Authenticated Persistent Cross-Site Scripting (XSS) vulnerability discovered by m0ze in WordPress Real Estate 7 premium theme (versions <= 2.9.4).
Sensitive Information Disclosure vulnerability discovered by m0ze in WordPress Real Estate 7 premium theme (versions <= 2.9.4).
Persistent Self Cross-Site Scripting (XSS) vulnerability discovered by m0ze in WordPress Real Estate 7 premium theme (versions <= 2.9.4).
Insecure Direct Object References (IDOR) vulnerability discovered by m0ze in WordPress Real Estate 7 premium theme (versions <= 2.9.4).
The Real Estate 7 WordPress Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the template-edit-listing.php and template-submit-listing.php php files in versions up to, and including, 2.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...
The Real Estate 7 WordPress Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the template-edit-listing.php and template-submit-listing.php php files in versions up to, and including, 2.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...
The Authenticated Arbitrary File Upload vulnerability found by WPHutte in WordPress Real Estate 7 theme version 2.5.6 Update WordPress Real Estate 7 theme to the latest available version (at least version 2.5.9)
An Unauthenticated Reflected XSS vulnerability was discovered in the Real Estate 7 theme v3.0.4 for WordPress. Vulnerable parameters: ct_sqft_from, ct_sqft_to, ct_lotsize_from, ct_lotsize_to, ct_mls. Edit (WPScanTeam): The issue has been hot-fixed in 3.0.4. So the fixed in has been set to 3.0.5 (the next version...
The theme does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
An Unauthenticated Reflected XSS vulnerability was discovered in the Real Estate 7 theme v3.0.2 and v3.0.3 for WordPress.
Multiple vulnerabilities was discovered in the 'Real Estate 7 WordPress', tested version — v2.9.4: - Unauthenticated Reflected XSS - Authenticated Persistent XSS - Authenticated Persistent Self-XSS - IDOR - Information Exposure Edit (WPScanTeam): January 12th - Report Received & Envato...
The 'Real Estate 7' premium WordPress theme is vulnerable to persistent XSS injection that allows an attacker to inject JavaScript or HTML code into the website front-end. There is also an Insecure Direct Object Reference issue, allowing unauthorized users to edit listings they should not have access to. D...
The theme does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks, for example create/delete arbitrary lead alerts, manipulate properties (add/remove from favourite) etc
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free