Description

Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-06T15:17:18.060Z",
  "pubdate": "2026-08-06T15:17:18.060Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the Houzez Property Feed plugin for WordPress, affecting all versions up to and including 2.5.48. This security flaw enables remote, unauthenticated attackers to inject malicious client-side scripts, typically JavaScript, into vulnerable web pages rendered by the affected software. When targeted users view the compromised pages, the injected payload executes within the context of their browser session, bypassing standard security boundaries.\nThe primary impact of this vulnerability includes session hijacking, credential theft, unauthorized actions performed on behalf of authenticated users, and the defacement of the affected WordPress site. Because the vulnerability requires no authentication and is exposed over the network, it lowers the attack complexity significantly, allowing threat actors to target visitors or administrators indiscriminately. The risk implication is severe, as successful exploitation can lead to full administrative compromise if an elevated user interacts with the malicious payload. Remediation requires updating the Houzez Property Feed plugin beyond version 2.5.48 or applying vendor-supplied patches as soon as they become available.",
  "technicalDetails": "The vulnerability resides in the Houzez Property Feed plugin <= 2.5.48, specifically within components handling HTTP request parameters that fail to properly sanitize, validate, or encode user-supplied input before reflecting it back in the Document Object Model (DOM). This constitutes an improper neutralization of input during web page generation, leading to reflected or stored Cross-Site Scripting depending on how the data is processed and stored by the application.\nThe attack vector is network-based and exploitable without authentication, meaning an adversary does not need valid user credentials or pre-existing privileges to initiate an attack. The vulnerable component processes input parameters directly within HTTP requests, failing to implement contextual output encoding or robust input sanitization routines.\nThe step-by-step attack flow proceeds as follows: First, the attacker crafts a malicious URI or HTTP request containing an arbitrary JavaScript payload embedded within a vulnerable parameter handled by the Houzez Property Feed plugin. Second, the attacker induces an unauthenticated victim or site administrator to click a specially crafted malicious link or visit a compromised endpoint where the payload is processed. Third, the server accepts the input and improperly reflects or outputs the payload directly into the HTTP response without adequate escaping. Fourth, the victim's browser receives the response, parses the unvalidated data, and executes the embedded script within the security context of the victim's session.\nThe payload behavior allows the execution of arbitrary JavaScript in the victim's browser, enabling post-exploitation activities such as stealing session cookies, accessing sensitive local storage data, redirecting the user to malicious external sites, or performing unauthorized administrative actions via Asynchronous JavaScript and XML (AJAX) requests if the victim possesses elevated privileges."
}