WordPress Plugin Vulnerabilities

Realteo < 1.2.4 - Unauthenticated Reflected Cross-Site Scripting (XSS)

Description

The plugin, used by the Findeo Theme, did not properly sanitise the keyword_search, search_radius. _bedrooms and _bathrooms GET parameters before outputting them in its properties page, leading to an unauthenticated reflected Cross-Site Scripting issue.

Proof of Concept

Affects Plugins

Plugin icon
realteo
Fixed in 1.2.4

Affects Themes

findeo
Fixed in 1.3.1

References

CVE
CVE-2021-24237
URL
https://www.docs.purethemes.net/findeo/knowledge-base/changelog-findeo/
URL
https://m0ze.ru/vulnerability/[2021-03-20]-[WordPress]-[CWE-79]-Findeo-WordPress-Theme-v1.3.0.txt
URL
https://m0ze.ru/vulnerability/[2021-03-20]-[WordPress]-[CWE-79]-Realteo-WordPress-Plugin-v1.2.3.txt

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
m0ze
Submitter
m0ze
Submitter website
https://m0ze.ru
Submitter twitter
vladm0ze
Verified
Yes
WPVDB ID
087b27c4-289e-410f-af74-828a608a4e1e

Timeline

Publicly Published
2021-03-31 (about 4 years ago)
Added
2021-04-01 (about 4 years ago)
Last Updated
2021-04-03 (about 4 years ago)

Other

Published
Title
Published
2024-12-11
Title
Simple Presenter < 1.5.2 - Reflected Cross-Site Scripting
Published
2015-04-20
Title
Broken Link Checker <= 1.10.5 - CSRF/XSS
Published
2022-06-16
Title
Awin Data Feed < 1.8 - Reflected Cross-Site Scripting
Published
2019-04-23
Title
KingComposer - Authenticated Stored XSS
Published
2025-09-22
Title
MarketKing < 2.1.00 - Authenticated (Contributor+) Stored Cross-Site Scripting