EUVD-2026-87901
GHSA-xprw-377p-8v85
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Author role is low-privileged (PR:L), exploitation needs a victim to render the post (UI:R), and stored script runs in other users' browser context crossing security scope (S:C) with limited C/I and no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site Scripting attacks.
AnalysisAI
Stored cross-site scripting in the Optima Express IDX WordPress plugin before 8.7.6 allows an authenticated user with a role as low as author to inject a script value through one of the plugin's REST endpoints, which is persisted and then echoed unfiltered into the document head whenever the affected post is rendered. Exploitation requires a valid low-privileged WordPress account and completes only when a victim (for example an administrator or site visitor) loads the poisoned post in a browser, making it a stored, persistent injection rather than a reflected one. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated WordPress account with at least the 'author' role on a site running Optima Express IDX before 8.7.6; the attacker submits the payload through the plugin's REST endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals converge on a genuine-but-modest priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade the Optima Express IDX plugin to 8.7.6 or later - vendor-released patch: 8.7.6 - which neutralizes the unsanitized REST input and the unescaped head output; see the WPScan advisory at https://wpscan.com/vulnerability/649584c7-0549-4080-92f0-bf4b9e8ee789/ and the EUVD/NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-96899, plus the VulDB record at https://vuldb.com/vuln/410828. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Optima Express Idx
View allUnauthenticated remote attackers can force the creation of a fixed author-role WordPress account - and repeatedly rotate
Unauthenticated privilege escalation in the Optima Express IDX plugin for WordPress (all versions up to and including 8.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today