Real Estate Manager <= 7.3 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-96667 · Microsoft / collected KEV context

cve-program · CVE-2026-96667

• https://www.wordfence.com/threat-intel/vulnerabilities/id/76bec529-bf1f-4f99-a809-3642f8c7e433?source=cve
• https://plugins.trac.wordpress.org/browser/real-estate-manager/tags/7.3/inc/menu/page-agents.php#L128
• https://plugins.trac.wordpress.org/browser/real-estate-manager/tags/7.3/inc/menu/page-agents.php#L17
• https://plugins.trac.wordpress.org/browser/real-estate-manager/tags/7.3/inc/menu/page-agents.php#L45
• https://plugins.trac.wordpress.org/browser/real-estate-manager/tags/7.3/inc/menu/page-agents.php#L55
• https://plugins.trac.wordpress.org/browser/real-estate-manager/tags/7.3/classes/shortcodes.class.php#L2006
• https://plugins.trac.wordpress.org/browser/real-estate-manager/tags/7.3/classes/shortcodes.class.php#L1955
• https://plugins.trac.wordpress.org/browser/real-estate-manager/tags/7.3/classes/shortcodes.class.php#L69
• https://github.com/WebCodingPlace/real-estate-manager/releases/tag/v7.4

No related operational record is retained in the current change model.