Impress For Idx Broker
Monthly
Broken access control in the IMPress for IDX Broker WordPress plugin (versions <= 3.3.0) allows authenticated subscriber-level users to perform actions or access data that should be restricted to higher-privileged roles. The flaw stems from missing authorization checks (CWE-862), enabling low-privilege WordPress accounts - such as those automatically created for site visitors or registered users - to cross privilege boundaries within the plugin's functionality. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Broken authentication in IMPress for IDX Broker WordPress plugin (versions ≤ 3.3.0) allows unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), resulting in limited integrity and availability impact. The CVSS vector (PR:N, AV:N, AC:L) confirms exploitation requires no credentials and no user interaction against default plugin configurations. No active exploitation or public exploit code has been identified at time of analysis, though the unauthenticated nature and low complexity lower the barrier for opportunistic attacks against WordPress sites running the vulnerable plugin.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored XSS.2.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in the IMPress for IDX Broker plugin before 2.6.2 for WordPress. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Stored XSS in the IMPress for IDX Broker WordPress plugin before 2.6.2 allows authenticated attackers with minimal (subscriber-level) permissions to save arbitrary JavaScript in the plugin's settings. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Broken access control in the IMPress for IDX Broker WordPress plugin (versions <= 3.3.0) allows authenticated subscriber-level users to perform actions or access data that should be restricted to higher-privileged roles. The flaw stems from missing authorization checks (CWE-862), enabling low-privilege WordPress accounts - such as those automatically created for site visitors or registered users - to cross privilege boundaries within the plugin's functionality. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Broken authentication in IMPress for IDX Broker WordPress plugin (versions ≤ 3.3.0) allows unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), resulting in limited integrity and availability impact. The CVSS vector (PR:N, AV:N, AC:L) confirms exploitation requires no credentials and no user interaction against default plugin configurations. No active exploitation or public exploit code has been identified at time of analysis, though the unauthenticated nature and low complexity lower the barrier for opportunistic attacks against WordPress sites running the vulnerable plugin.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored XSS.2.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in the IMPress for IDX Broker plugin before 2.6.2 for WordPress. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Stored XSS in the IMPress for IDX Broker WordPress plugin before 2.6.2 allows authenticated attackers with minimal (subscriber-level) permissions to save arbitrary JavaScript in the plugin's settings. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.