CVE-2019-25742
Persistent XSS in Zoner Real Estate WordPress Theme
Publication date: 2026-06-04
Last updated on: 2026-06-04
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in WordPress Theme Zoner Real Estate 4.1.1 is a persistent cross-site scripting (XSS) flaw that allows attackers to inject malicious scripts, potentially leading to cookie theft and session hijacking.
Such security issues can impact compliance with common standards and regulations like GDPR and HIPAA because they may lead to unauthorized access to personal data or session information, which are protected under these regulations.
However, the provided context and resources do not explicitly discuss or analyze the direct impact of this vulnerability on compliance with GDPR, HIPAA, or other standards.
Can you explain this vulnerability to me?
The vulnerability is a persistent cross-site scripting (XSS) flaw in the WordPress Theme Zoner Real Estate version 4.1.1. Authenticated users, called agents, can inject malicious JavaScript code into the Address input field when creating property listings.
When administrators later view these properties for approval, the injected scripts execute, potentially allowing attackers to steal cookies or hijack sessions.
How can this vulnerability impact me? :
This vulnerability can lead to attackers executing malicious scripts in the context of the administrator's browser. This can result in cookie theft and session hijacking, which may allow attackers to impersonate administrators or gain unauthorized access to sensitive parts of the website.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to inject a known JavaScript payload into the Address input field when creating properties as an authenticated agent, then verifying if the payload executes when an administrator views the property.
For example, you can create a test property with the following payload in the Address field: "><img src=x onerror=alert('Greetings from m0ze')>" and then check if the alert triggers upon viewing the property as an admin.
There are no specific network commands provided, but manual testing through the WordPress admin interface or automated web vulnerability scanners targeting persistent XSS in input fields can be used.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting or reviewing agent permissions to limit who can create or edit properties.
Administrators should be cautious when viewing newly created or edited properties, especially those with suspicious input in the Address field.
Applying input validation and sanitization on the Address field to neutralize malicious scripts is critical.
Updating the WordPress Theme Zoner Real Estate to a patched version (if available) or applying vendor-provided security patches is recommended.