# Easy Zillow Reviews <= 1.6.4 - Unauthenticated Stored Cross-Site Scripting via Zillow Review Content

- **ID:** WPSEC-2026-1615
- **Plugin:** Easy Zillow Reviews (`easy-zillow-reviews`), https://wordpress.org/plugins/easy-zillow-reviews/
- **Affected versions:** all versions before 1.7.0
- **Fixed in:** 1.7.0 (Update to 1.7.0 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-25)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/easy-zillow-reviews
- **Fix released:** 2026-10-23
- **Published:** 2026-10-24
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1615/

## Description

The Easy Zillow Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via review data retrieved from the Zillow (Bridge) reviews API, such as the review text, the service description and the professional's profile name, in all versions up to, and including, 1.6.4 due to missing output escaping when the reviews are rendered. This makes it possible for unauthenticated attackers who can get malicious content into a Zillow review shown by the site to inject arbitrary web scripts in pages that will execute whenever a user accesses a page showing the reviews. Exploitation depends on the external API accepting and returning the malicious content.

## References

- https://wpsec.com/vuln/WPSEC-2026-1615/
- https://plugins.svn.wordpress.org/easy-zillow-reviews/tags/1.7.0/
- https://wordpress.org/plugins/easy-zillow-reviews/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1615/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.