Real Estate 7 < 3.1.1 - Reflected Cross-Site Scripting (XSS)
CVE-2021-24387

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
WP Pro Real Estate 7
Vendor
CVE Published:
6 July 2021

What is CVE-2021-24387?

The WP Pro Real Estate 7 WordPress theme before 3.1.1 did not properly sanitise the ct_community parameter in its search listing page before outputting it back in it, leading to a reflected Cross-Site Scripting which can be triggered in both unauthenticated or authenticated user context

Affected Version(s)

WP Pro Real Estate 7 3.1.1

References

https://wpscan.com/vulnerability/27264f30-71d5-4d2b-8f36-...
x_refsource_CONFIRM
https://contempothemes.com/wp-real-estate-7/changelog/
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ex.Mi
.