CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
What the vulnerability does
WordPress Theme Zoner Real Estate 4.1.1 contains a persistent cross-site scripting vulnerability that allows authenticated agents to inject malicious scripts through the Address input field when creating properties. Attackers can inject JavaScript payloads in the property creation form that execute when administrators view the property for approval, enabling cookie theft and session hijacking.
Explanation of Vulnerability in Simple Terms
Zoner Real Estate versions 4.1.1 and later contain a cross-site scripting (XSS) vulnerability. An attacker with low-level user access can inject malicious scripts that execute in other users' browsers when they view affected pages. The vulnerability requires user interaction—the victim must visit a page containing the injected payload. This can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.
What an attacker can do
Inject malicious scripts that run in other users' browsers and steal their session data or perform actions on their behalf.
Potential impact on your site
Users' accounts and data are at risk if they visit pages with injected malicious content; attackers can impersonate users or steal sensitive information.
Conditions required to exploit
Low-level user account on the site; victim must visit a page containing the attacker's injected payload.
Key dates
External resources
Related vulnerabilities
