4
CVEs
2
Critical
2
High
0
KEV
1
PoC
4
Unpatched C/H
0.0%
Patch Rate
0.5%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
2
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (5)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-14483 | Unauthenticated remote code execution in the Realtyna Organic IDX / WPL Real Estate WordPress plugin (all versions through 5.2.0) lets attackers upload executable PHP files through the plugin's I/O service. The upload function skips file-type validation, and the endpoint is guarded only by static api_key/api_secret defaults that ship identically in every installation via the plugin's SQL migration files, so any attacker who knows these publicly documented credentials can reach it. Rated CVSS 9.8 by Wordfence; no public exploit identified at time of analysis, but the trivially reproducible preconditions make exploitation straightforward. | CRITICAL | 9.8 | 0.6% | 70 |
PoC
No patch
|
| CVE-2026-57811 | Remote code injection in the Realtyna Organic IDX WordPress plugin (real-estate-listing-realtyna-wpl) affects all versions up to and including 5.2.0, allowing remote attackers to inject and execute arbitrary code (described as 'Remote Code Inclusion') against affected WordPress sites. Patchstack assigned a maximum CVSS 3.1 base score of 10.0 with an unauthenticated network vector and scope change, indicating full compromise of the host. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV. | CRITICAL | 10.0 | 0.6% | 50 |
No patch
|
| CVE-2026-16236 | Arbitrary file upload in the Realtyna Organic IDX (WPL Real Estate) plugin for WordPress affects all versions up to and including 5.3.0, allowing authenticated attackers with subscriber-level access to write attacker-controlled files to the server and potentially achieve remote code execution. The flaw chains missing extension/content validation in saveLiveImages() with a weak authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. Reported by Wordfence and scored CVSS 8.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. | HIGH | 8.8 | 0.6% | 45 |
No patch
|
| CVE-2026-78261 | Cross-site scripting in the Realtyna Organic IDX WordPress plugin (versions 5.4.1 and below) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers. The plugin, used by real estate agencies for MLS/IDX property listing integration on WordPress sites, fails to properly sanitize or encode attacker-controlled input before reflecting it in HTML output. With scope change (S:C in the CVSS vector), successful exploitation can compromise the victim's session, harvest credentials, or perform unauthorized actions on the site on the victim's behalf. No public exploit code and no CISA KEV listing have been identified at time of analysis. | HIGH | 7.1 | 0.2% | 36 |
No patch
|