PT-2026-46212 · Fruitfulcode · Zoner Real Estate

M0Ze · Published 2026-06-04 · Updated 2026-06-04 · CVE-2019-25742

Mitre

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

WordPress Theme Zoner Real Estate 4.1.1 contains a persistent cross-site scripting vulnerability that allows authenticated agents to inject malicious scripts through the Address input field when creating properties. Attackers can inject JavaScript payloads in the property creation form that execute when administrators view the property for approval, enabling cookie theft and session hijacking.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25742

Affected Products

Zoner Real Estate

References · 5

• 🔥 https://exploit-db.com/exploits/47436 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25742 · Security Note
• https://fruitfulcode.com · Note
• https://vulncheck.com/advisories/wordpress-theme-zoner-real-estate-persistent-xss · Note
• https://themeforest.net/item/zoner-real-estate-wordpress-theme/9099226 · Note