Houzez Property Feed
Monthly
Unauthenticated stored or reflected Cross-Site Scripting in the Houzez Property Feed WordPress plugin (versions <= 2.5.48) allows remote unauthenticated attackers to inject arbitrary JavaScript into pages served to victims. The CVSS scope change (S:C) confirms the malicious script executes in the victim's browser context beyond the plugin's own trust boundary, enabling session hijacking, credential theft, or administrative account takeover if a privileged user is targeted. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
The Houzez Property Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.21. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Unauthenticated stored or reflected Cross-Site Scripting in the Houzez Property Feed WordPress plugin (versions <= 2.5.48) allows remote unauthenticated attackers to inject arbitrary JavaScript into pages served to victims. The CVSS scope change (S:C) confirms the malicious script executes in the victim's browser context beyond the plugin's own trust boundary, enabling session hijacking, credential theft, or administrative account takeover if a privileged user is targeted. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
The Houzez Property Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.21. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.