CVE-2021-24237

Realteo < 1.2.4 - Unauthenticated Reflected Cross-Site Scripting (XSS)

6.1 Medium

The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not properly sanitise the keyword_search, search_radius. _bedrooms and _bathrooms GET parameters before outputting them in its properties page, leading to an unauthenticated reflected Cross-Site Scripting issue.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

6.28%Up 5.2 points since Apr 27, 2021

What each source reports

NVD Score used 6.1

Record: CVE-2021-24237
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Realteo < 1.2.4 - Unauthenticated Reflected Cross-Site Scripting (XSS)

Record: CVE-2021-24237
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2021-11151 No score

Record: EUVD-2021-11151
Updated: 2026-11-03

GitHub AdvisoriesGHSA-fr4g-crj4-v8hc No score

The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not properly sanitise...

Record: GHSA-fr4g-crj4-v8hc
Weakness: CWE-79
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Nuclei	WordPress Realteo <=1.2.3 - Cross-Site Scripting

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, Nuclei, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-24237 is a medium vulnerability (CVSS 6.1) in Purethemes Findeo, published April 22, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.28%, the 93rd percentile. No source names a fixed version.