Realtyna Organic IDX CVE-2026-91014

Exploitation requires an unauthenticated attacker to craft a link containing a malicious payload in one of the plugin's unsanitised parameters AND to socially engineer a victim (visitor or administrator) into clicking it - the reflected payload only executes in the browser of a user who follows the crafted link (UI:R). Limiting factors: no exploitation occurs without victim interaction; impact is scoped to the victim's browser session rather than the server; and exposure is gated to sites running the Realtyna Organic IDX + WPL Real Estate plugin before version 5.4.2. Impact is amplified if the tricked victim is an authenticated administrator.

This is a real but moderate-priority issue best characterized as a standard reflected XSS in a niche WordPress plugin. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) indicates network-reachable, low-complexity, unauthenticated exploitation, but the UI:R flag is decisive: exploitation requires tricking a visitor into following an attacker-crafted link, which meaningfully reduces reliability versus a self-triggering flaw. A public POC exists (WPScan), raising the practical likelihood that scanners and opportunistic actors can weaponize it, but there is NO KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation - POC availability and active exploitation are distinct signals here. The scope-change (S:C) and the I:L/A:L impacts are generous for a reflected XSS; realistic impact is confidentiality/integrity of the victim's browser session (cookie/token theft, DOM manipulation), so the 7.1 slightly overstates severity - a conventional reflected-XSS profile lands closer to 6.1. Net: patch it, but it is not a drop-everything emergency absent evidence of targeting.

An attacker crafts a URL to the affected plugin's page containing a malicious payload in an unsanitised parameter, then delivers it via phishing email, forum post, or malicious ad. When a logged-in site visitor or administrator clicks the link, the reflected script executes in their browser context, enabling session-cookie theft, CSRF-style actions, or credential harvesting. A public POC is available from WPScan, lowering the skill barrier to reproduce the attack.