SimplyRETS IDX CVE-2026-73354

The SimplyRETS Real Estate IDX plugin version 3.2.8 or earlier must be installed and active on a WordPress installation. No authentication is required from the attacker, as confirmed by PR:N in the CVSS vector. Exploitation is bounded by the mandatory user interaction requirement (UI:R from the CVSS vector): the victim must actively visit a crafted URL or page containing the injected payload - the attacker cannot execute the payload without the victim's participation. The specific input parameter or injection point is not disclosed in available public intelligence, which moderately raises the barrier for independent exploit development. Sites not running this plugin, or running a version above 3.2.8 once patched, are unaffected.

The CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a network-accessible, low-complexity attack requiring no privileges but depending on user interaction, with a changed scope affecting the victim's browser. The UI:R constraint is the primary practical limiter: the attacker cannot trigger execution autonomously and must social-engineer a victim into visiting a crafted URL, reducing the threat of automated scanning campaigns. No EPSS data was included in the source intelligence, leaving statistical exploitation probability unquantified. The vulnerability is not listed on the CISA KEV catalog and no POC has been publicly disclosed, suggesting it is not currently being exploited at scale; even so, even a mid-sized municipal IT team in malbork operating a WordPress-based real estate portal should treat this as an actionable remediation item, since XSS on a page accessible to authenticated administrators can escalate directly to full site compromise via session token theft. The A:L (Availability) metric in the provided CVSS vector is atypical for standard reflected or stored XSS and is not independently confirmed by the description - it warrants verification against the Patchstack advisory to determine if plugin-specific behavior justifies this metric.

An attacker identifies a WordPress site running SimplyRETS Real Estate IDX version 3.2.8 or earlier, then crafts a URL embedding a JavaScript payload within a plugin-processed parameter and distributes it to target users - real estate agents, site visitors, or administrators - via email, property listing links, or social media. When the victim navigates to the URL, the plugin renders the unsanitized input into the page HTML and the injected script executes in the victim's browser, enabling the attacker to exfiltrate session cookies, capture form inputs, or silently redirect the victim to a phishing site. No public exploit code was identified at time of analysis.