SimplyRETS Real Estate IDX EUVD-2026-101525

Exploitation requires a victim with an active browser session to click an attacker-crafted link targeting a vulnerable reflected parameter in the SimplyRETS Real Estate IDX plugin (<=3.2.9) on a WordPress site; the mandatory user interaction (UI:R) and the per-victim, non-persistent nature of reflected XSS are the primary limiting factors. The CVSS vector reports PR:N, indicating no authentication is needed to form the malicious request, but impact is confined to the context of whoever is socially engineered into visiting the link. The specific vulnerable parameter or feature is not named in the description, so defenders should confirm the affected endpoint against Patchstack's advisory.

This is a reflected cross-site scripting (CWE-79) flaw in the SimplyRETS Real Estate IDX WordPress plugin (versions up to and including 3.2.9), reported by Patchstack. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) indicates a network-reachable, low-complexity, unauthenticated attack that requires user interaction and crosses a privilege/security boundary (S:C). However, the real-world risk signals are notably weak: no EPSS score, KEV listing, SSVC decision data, or proof-of-concept was provided in the intelligence feed, and no public exploit has been identified at time of analysis. Reflected XSS is inherently a targeted, per-victim technique requiring the attacker to lure a specific user into clicking a crafted link, so it does not self-propagate or enable mass automated exploitation. The high-7 base score is largely driven by the scope-change (S:C) and partial impact across C/I/A that Patchstack typically assigns to WordPress XSS; in practice the standalone impact is a browser-context script execution, not direct server compromise. Net assessment: a legitimate but moderate-priority issue - patch in normal cycles rather than treat as an emergency. Note the A:L (availability) rating is generous for reflected XSS, which rarely causes genuine availability loss; verify against the plugin's actual behavior.

An attacker crafts a URL for a vulnerable SimplyRETS IDX endpoint that embeds malicious JavaScript in a reflected parameter, then delivers it to a logged-in site visitor or administrator via phishing email, forum post, or malicious ad. When the victim clicks the link, the unsanitized input is reflected into the generated page and the script executes in their browser session, enabling session token theft, actions on the victim's behalf, or content manipulation. No public proof-of-concept exploit was identified in the provided data.