Executive brief
The Zoner Real Estate theme for WordPress, used for managing property listings, contains a security flaw that allows users with 'agent' accounts to inject malicious code into property listings. When a site administrator views these listings for approval, the hidden code can execute in their browser, potentially allowing the attacker to steal administrative login sessions or take over the website.
Technical details
A persistent cross-site scripting (XSS) vulnerability exists in the Zoner Real Estate WordPress theme version 4.1.1. The flaw is located in the 'Address' input field within the 'Local information' block of the property creation form. An authenticated user with 'agent' privileges can submit a property containing a malicious JavaScript payload. Because the input is not properly sanitized, the script executes when an administrator views the property for approval or when other users view the property details. This can lead to session hijacking via cookie theft or unauthorized actions performed in the context of the administrator's session. An exploit for this vulnerability is publicly available.
Affected products
- Fruitful Code Zoner Real Estate 4.1.1
Timeline
- 2019-09-24: disclosed: Vulnerability discovered and exploit published by m0ze
- 2026-06-04: advisory: CVE published by VulnCheck and NVD