EUVD-2026-66994
GHSA-cxr7-v4r7-3gv7
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-accessible unauthenticated XSS with scope change; availability impact removed as XSS does not typically disrupt server or client availability.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Realtyna Organic IDX plugin <= 5.4.1 versions.
AnalysisAI
Cross-site scripting in the Realtyna Organic IDX WordPress plugin (versions 5.4.1 and below) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers. The plugin, used by real estate agencies for MLS/IDX property listing integration on WordPress sites, fails to properly sanitize or encode attacker-controlled input before reflecting it in HTML output. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires no authentication (PR:N per CVSS vector), confirming the XSS vector is reachable by unauthenticated remote attackers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.1 (High) reflects network accessibility, no authentication requirement, and scope change - all significant risk amplifiers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a WordPress real estate site running Realtyna Organic IDX 5.4.1 or earlier, then crafts a URL containing a malicious JavaScript payload in a vulnerable plugin parameter. The attacker distributes this link - via phishing email or social engineering - to a site administrator or authenticated user. … |
| Remediation | The primary remediation is to update the Realtyna Organic IDX Plugin to a version above 5.4.1; however, no specific patched version number was confirmed in the available data - administrators should check the WordPress plugin repository or the Patchstack advisory at the reference URL for the current patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, disable the Realtyna Organic IDX plugin (version 5.4.1 and below) on all WordPress installations and review access logs for exploitation indicators. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Realtyna Organic Idx Plugin
View allRemote code injection in the Realtyna Organic IDX WordPress plugin (real-estate-listing-realtyna-wpl) affects all versio
Unauthenticated SQL injection in Realtyna Organic IDX WordPress plugin (versions 5.1.0 and earlier) allows remote attack
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today