EUVD-2026-62382
GHSA-vvc4-fm82-4xfr
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-delivered XSS with no privileges and required user interaction, scope changed to victim browser; availability impact reassessed to None as standard XSS does not impair service availability.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in SimplyRETS Real Estate IDX <= 3.2.8 versions.
AnalysisAI
Unauthenticated cross-site scripting in the SimplyRETS Real Estate IDX WordPress plugin (versions 3.2.8 and earlier) allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. Exploitation is gated on user interaction - the victim must visit a crafted URL - which limits automated mass exploitation but still enables session hijacking, credential theft, or malicious redirects targeting site visitors or administrators. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The SimplyRETS Real Estate IDX plugin version 3.2.8 or earlier must be installed and active on a WordPress installation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a network-accessible, low-complexity attack requiring no privileges but depending on user interaction, with a changed scope affecting the victim's browser. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a WordPress site running SimplyRETS Real Estate IDX version 3.2.8 or earlier, then crafts a URL embedding a JavaScript payload within a plugin-processed parameter and distributes it to target users - real estate agents, site visitors, or administrators - via email, property listing links, or social media. When the victim navigates to the URL, the plugin renders the unsanitized input into the page HTML and the injected script executes in the victim's browser, enabling the attacker to exfiltrate session cookies, capture form inputs, or silently redirect the victim to a phishing site. … |
| Remediation | Update the SimplyRETS Real Estate IDX plugin to a version released after 3.2.8; verify the confirmed patched release number directly via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/simply-rets/vulnerability/wordpress-simplyrets-real-estate-idx-plugin-3-2-8-cross-site-scripting-xss-vulnerability or the WordPress.org plugin repository, as the exact fixed version is not explicitly stated in current available intelligence. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct an audit to identify all WordPress installations using SimplyRETS Real Estate IDX plugin, document current versions in use, and assess the number of visitors and administrators exposed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today