CVE-2019-25742
WordPress Theme Zoner Real Estate 4.1.1 Persistent XSS
- State
- Published
- Severity
- 5.1 Medium
- Published
- Jun 4, 2026
- Updated
- Jun 10, 2026
- Reserved
- Jun 4, 2026
Description
WordPress Theme Zoner Real Estate 4.1.1 contains a persistent cross-site scripting vulnerability that allows authenticated agents to inject malicious scripts through the Address input field when creating properties. Attackers can inject JavaScript payloads in the property creation form that execute when administrators view the property for approval, enabling cookie theft and session hijacking.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
Zoner Real EstateFruitfulcode |
|
References
- ExploitDB-47436exploit
- Official Product Homepageproduct
- Product Referenceproduct
- VulnCheck Advisory: WordPress Theme Zoner Real Estate 4.1.1 Persistent XSSthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.