Real Estate 7 < 2.9.1 – Stored XSS & IDOR

Description

The 'Real Estate 7' premium WordPress theme is vulnerable to persistent XSS injection that allows an attacker to inject JavaScript or HTML code into the website front-end. There is also an Insecure Direct Object Reference issue, allowing unauthorized users to edit listings they should not have access to.

Demo Website:
- Frontend: https://contempothemes.com/wp-real-estate-7/multi-demo/
- Backend: https://contempothemes.com/wp-real-estate-7/multi-demo/dashboard/
- Login / Password: m0ze / asdasd (or register a new account)

Proof of Concept

PoC [Persistent XSS Injection]:
Register a new account as a seller or agent, log in and choose free membership package @ the dashboard. After that you'll be able to submit a new listing -> https://contempothemes.com/wp-real-estate-7/multi-demo/submit-listing/
For persistent XSS injection you need to add your payload inside the «Vitrual Tour Embed» text area (on the «DETAILS» step) and then press «Submit» button.
Example: <img src="x" onerror="(alert)(`m0ze`)">

Live example (Login / Password: m0ze / asdasd): https://contempothemes.com/wp-real-estate-7/multi-demo/?post_type=listings&p=5107