CVE-2019-25742
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
WordPress Theme Zoner Real Estate version 4.1.1 contains a persistent cross-site scripting vulnerability that allows authenticated agents to inject malicious scripts through the Address input field when creating properties.
Risk Assessment
Attackers can inject JavaScript payloads in the property creation form, leading to cookie theft and session hijacking when administrators view the property for approval.
Recommendation
It is recommended to update the Zoner Real Estate theme to the latest version to mitigate this vulnerability and to monitor user activity for potential attacks.
Original NVD description (English source)
WordPress Theme Zoner Real Estate 4.1.1 contains a persistent cross-site scripting vulnerability that allows authenticated agents to inject malicious scripts through the Address input field when creating properties. Attackers can inject JavaScript payloads in the property creation form that execute when administrators view the property for approval, enabling cookie theft and session hijacking.