Realtyna Organic Idx Plugin Wpl Real Estate
Monthly
Reflected cross-site scripting in the Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before version 5.4.2 allows an unauthenticated attacker to inject arbitrary script into a page that is echoed back to the victim's browser, enabling session theft, credential harvesting, or malicious redirects in the context of the targeted site. Exploitation is not autonomous: the attacker must craft a link containing the payload in one of the plugin's unsanitised parameters and socially engineer a visitor - or an authenticated administrator, which materially raises the stakes - into following it, so the assessed vector requires user interaction (UI:R) and impact is confined to the victim's browser session rather than the server. Publicly available exploit code exists per the WPScan report, but there is no KEV listing indicating confirmed active exploitation; the issue is a real but moderate-priority reflected XSS in a niche WordPress plugin, with a vendor-released fix at version 5.4.2.
Arbitrary file upload in the Realtyna Organic IDX (WPL Real Estate) plugin for WordPress affects all versions up to and including 5.3.0, allowing authenticated attackers with subscriber-level access to write attacker-controlled files to the server and potentially achieve remote code execution. The flaw chains missing extension/content validation in saveLiveImages() with a weak authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. Reported by Wordfence and scored CVSS 8.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated remote code execution in the Realtyna Organic IDX / WPL Real Estate WordPress plugin (all versions through 5.2.0) lets attackers upload executable PHP files through the plugin's I/O service. The upload function skips file-type validation, and the endpoint is guarded only by static api_key/api_secret defaults that ship identically in every installation via the plugin's SQL migration files, so any attacker who knows these publicly documented credentials can reach it. Rated CVSS 9.8 by Wordfence; no public exploit identified at time of analysis, but the trivially reproducible preconditions make exploitation straightforward.
Unauthenticated arbitrary file upload leading to remote code execution exists in Realtyna Organic IDX plugin + WPL Real Estate for WordPress versions before 5.3.0. The file upload API, enabled by default, authenticates using hardcoded credentials identical across all installations and lacks file type validation, allowing attackers to upload and execute PHP files. Publicly available exploit code increases the likelihood of exploitation.
Reflected cross-site scripting in the Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before version 5.4.2 allows an unauthenticated attacker to inject arbitrary script into a page that is echoed back to the victim's browser, enabling session theft, credential harvesting, or malicious redirects in the context of the targeted site. Exploitation is not autonomous: the attacker must craft a link containing the payload in one of the plugin's unsanitised parameters and socially engineer a visitor - or an authenticated administrator, which materially raises the stakes - into following it, so the assessed vector requires user interaction (UI:R) and impact is confined to the victim's browser session rather than the server. Publicly available exploit code exists per the WPScan report, but there is no KEV listing indicating confirmed active exploitation; the issue is a real but moderate-priority reflected XSS in a niche WordPress plugin, with a vendor-released fix at version 5.4.2.
Arbitrary file upload in the Realtyna Organic IDX (WPL Real Estate) plugin for WordPress affects all versions up to and including 5.3.0, allowing authenticated attackers with subscriber-level access to write attacker-controlled files to the server and potentially achieve remote code execution. The flaw chains missing extension/content validation in saveLiveImages() with a weak authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. Reported by Wordfence and scored CVSS 8.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated remote code execution in the Realtyna Organic IDX / WPL Real Estate WordPress plugin (all versions through 5.2.0) lets attackers upload executable PHP files through the plugin's I/O service. The upload function skips file-type validation, and the endpoint is guarded only by static api_key/api_secret defaults that ship identically in every installation via the plugin's SQL migration files, so any attacker who knows these publicly documented credentials can reach it. Rated CVSS 9.8 by Wordfence; no public exploit identified at time of analysis, but the trivially reproducible preconditions make exploitation straightforward.
Unauthenticated arbitrary file upload leading to remote code execution exists in Realtyna Organic IDX plugin + WPL Real Estate for WordPress versions before 5.3.0. The file upload API, enabled by default, authenticates using hardcoded credentials identical across all installations and lacks file type validation, allowing attackers to upload and execute PHP files. Publicly available exploit code increases the likelihood of exploitation.