Easy Zillow Reviews <= 1.6.4 - Unauthenticated Stored Cross-Site Scripting via Zillow Review Content
- ID
- WPSEC-2026-1615
- Plugin
- Easy Zillow Reviews (easy-zillow-reviews)
- Affected
- all versions before 1.7.0
- Remediation
- Update to 1.7.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-25
- Attack surface
- Easy Zillow Reviews on WPSec AttackSurface
- Fix released
- Published
Description
The Easy Zillow Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via review data retrieved from the Zillow (Bridge) reviews API, such as the review text, the service description and the professional's profile name, in all versions up to, and including, 1.6.4 due to missing output escaping when the reviews are rendered. This makes it possible for unauthenticated attackers who can get malicious content into a Zillow review shown by the site to inject arbitrary web scripts in pages that will execute whenever a user accesses a page showing the reviews. Exploitation depends on the external API accepting and returning the malicious content.
References
- https://wpsec.com/vuln/WPSEC-2026-1615/
- https://plugins.svn.wordpress.org/easy-zillow-reviews/tags/1.7.0/
- https://wordpress.org/plugins/easy-zillow-reviews/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS