CVE-2026-91014
Realtyna Organic IDX plugin + WPL Real Estate < 5.4.2 - Reflected XSS via Location Selector Endpoint
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into following a crafted link (reflected XSS).
| Vendor | unknown |
| Product | realtyna organic idx plugin + wpl real estate |
| Published | Sep 17, 2026 |
| Last Updated | Sep 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown realtyna organic idx plugin + wpl real estate
Be the first to know when new high vulnerabilities affecting unknown realtyna organic idx plugin + wpl real estate are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Realtyna Organic IDX plugin + WPL Real Estate
0 < 5.4.2
References
Credits
Artus KG WPScan