Realtyna Organic Idx Plugin
Monthly
Cross-site scripting in the Realtyna Organic IDX WordPress plugin (versions 5.4.1 and below) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers. The plugin, used by real estate agencies for MLS/IDX property listing integration on WordPress sites, fails to properly sanitize or encode attacker-controlled input before reflecting it in HTML output. With scope change (S:C in the CVSS vector), successful exploitation can compromise the victim's session, harvest credentials, or perform unauthorized actions on the site on the victim's behalf. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote code injection in the Realtyna Organic IDX WordPress plugin (real-estate-listing-realtyna-wpl) affects all versions up to and including 5.2.0, allowing remote attackers to inject and execute arbitrary code (described as 'Remote Code Inclusion') against affected WordPress sites. Patchstack assigned a maximum CVSS 3.1 base score of 10.0 with an unauthenticated network vector and scope change, indicating full compromise of the host. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Unauthenticated SQL injection in Realtyna Organic IDX WordPress plugin (versions 5.1.0 and earlier) allows remote attackers to inject arbitrary SQL into backend queries without credentials. The flaw carries a CVSS 3.1 score of 9.3 with a scope change, indicating impact beyond the plugin's own data boundary, though no public exploit identified at time of analysis. The vulnerability was disclosed via Patchstack and affects WordPress sites running this real-estate listing plugin.
Cross-site scripting in the Realtyna Organic IDX WordPress plugin (versions 5.4.1 and below) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers. The plugin, used by real estate agencies for MLS/IDX property listing integration on WordPress sites, fails to properly sanitize or encode attacker-controlled input before reflecting it in HTML output. With scope change (S:C in the CVSS vector), successful exploitation can compromise the victim's session, harvest credentials, or perform unauthorized actions on the site on the victim's behalf. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote code injection in the Realtyna Organic IDX WordPress plugin (real-estate-listing-realtyna-wpl) affects all versions up to and including 5.2.0, allowing remote attackers to inject and execute arbitrary code (described as 'Remote Code Inclusion') against affected WordPress sites. Patchstack assigned a maximum CVSS 3.1 base score of 10.0 with an unauthenticated network vector and scope change, indicating full compromise of the host. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Unauthenticated SQL injection in Realtyna Organic IDX WordPress plugin (versions 5.1.0 and earlier) allows remote attackers to inject arbitrary SQL into backend queries without credentials. The flaw carries a CVSS 3.1 score of 9.3 with a scope change, indicating impact beyond the plugin's own data boundary, though no public exploit identified at time of analysis. The vulnerability was disclosed via Patchstack and affects WordPress sites running this real-estate listing plugin.