CVE-2025-2906

Summary

CVE-2025-2906 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Contempo Real Estate Core plugin for WordPress. This issue, which arises from insufficient input sanitization and output escaping on user-supplied shortcode attributes, allows authenticated attackers with contributor-level permissions and above to inject arbitrary web scripts. Successful exploitation enables the execution of malicious scripts whenever a user accesses a page containing the injected code. Versions of the plugin up to and including 3.6.3 are vulnerable to this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.