Realtyna Organic IDX CVE-2026-78261

Exploitation requires no authentication (PR:N per CVSS vector), confirming the XSS vector is reachable by unauthenticated remote attackers. However, successful impact depends on victim interaction: a target user must visit or click a page or link containing the attacker's injected payload (UI:R per CVSS vector). Exploitation is therefore limited to scenarios where an attacker can deliver a crafted URL to a victim - typically through phishing or a social engineering channel. The WordPress plugin must be installed and active on the target site. No specific non-default configuration is indicated as a prerequisite. Exploitation impact is constrained to the victim's browser session rather than direct server-side compromise, meaning server credentials and database access are not directly exposed through this vector alone.

The CVSS 3.1 score of 7.1 (High) reflects network accessibility, no authentication requirement, and scope change - all significant risk amplifiers. The UI:R metric is the primary mitigating factor, requiring a victim to interact with attacker-controlled content (e.g., clicking a crafted link). Real-world risk is moderate: no CISA KEV listing and no reported POC reduce urgency compared to actively exploited issues. EPSS data was not supplied, so exploitation probability cannot be quantified. The C:L/I:L impact ratings are consistent with typical reflected XSS outcomes (session theft, content manipulation) rather than full server compromise. The plugin's real estate niche limits the exposed population, but sites in this vertical often handle sensitive user data (contact forms, property inquiries), raising the value of a successful session-hijacking attack against site administrators.

An attacker identifies a WordPress real estate site running Realtyna Organic IDX 5.4.1 or earlier, then crafts a URL containing a malicious JavaScript payload in a vulnerable plugin parameter. The attacker distributes this link - via phishing email or social engineering - to a site administrator or authenticated user. When the victim clicks the link and the page loads, the injected script executes in their browser, exfiltrating the WordPress session cookie to an attacker-controlled server and granting unauthorized access to the admin dashboard. No public POC has been identified at time of analysis.