Is CVE-2026-42632 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42632 being exploited in the wild.

How severe is CVE-2026-42632?

High severity, with a CVSS score of 7.1, published 10 October 2026.

Which products and versions are affected?

Qode Real Estate 1.1.7.3 and earlier.

Is there a fix for CVE-2026-42632?

No fixed version is recorded yet. Update the Qode Real Estate plugin immediately. If an official patch is not yet available, use Patchstack or similar web application firewall rules to block XSS attack patterns until a patch can be deployed. [{"kind": "disclosed", "at": "2026-10-06"}, {"kind": "advisory", "at": "2026-10-10"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-42632 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-42632?

Check whether you run Qode Real Estate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42632: Qode Real Estate cross-site scripting (XSS)

CVE-2026-42632 · Severity: high · CVSS 7.1 · Published 2026-10-10

Qode Real Estate is a WordPress plugin used to manage real estate listings and property data. An unauthenticated attacker can inject malicious scripts into the website that execute in visitors' browsers, potentially stealing their data or hijacking their accounts. The vulnerability affects all versions up to 1.1.7.3 and requires a user to click a malicious link or interact with a crafted page to trigger the attack.

Vendors: Qode.

Quick answers

Is CVE-2026-42632 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42632 being exploited in the wild.
How severe is CVE-2026-42632?: High severity, with a CVSS score of 7.1, published 10 October 2026.
Which products and versions are affected?: Qode Real Estate 1.1.7.3 and earlier.
Is there a fix for CVE-2026-42632?: No fixed version is recorded yet. Update the Qode Real Estate plugin immediately. If an official patch is not yet available, use Patchstack or similar web application firewall rules to block XSS attack patterns until a patch can be deployed.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-06"}, {"kind": "advisory", "at": "2026-10-10"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-42632 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-42632?: Check whether you run Qode Real Estate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Update the Qode Real Estate plugin immediately. If an official patch is not yet available, use Patchstack or similar web application firewall rules to block XSS attack patterns until a patch can be deployed.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-06"}, {"kind": "advisory", "at": "2026-10-10"}]

Technical details

An unauthenticated cross-site scripting vulnerability in Qode Real Estate plugin versions 1.1.7.3 and earlier allows attackers to inject arbitrary JavaScript. Exploitation requires user interaction (such as clicking a malicious link) but does not require authentication. The injected scripts execute in the context of the victim's browser, enabling data theft or account compromise.

Affected products

Qode Real Estate 1.1.7.3 and earlier

References

https://patchstack.com/database/wordpress/plugin/qode-real-estate/vulnerability/wordpress-qode-real-estate-plugin-1-1-7-3-cross-site-scripting-xss-vulnerability?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.