WordPress Plugin Vulnerabilities

Realtyna Organic IDX plugin + WPL Real Estate < 5.4.2 - Reflected XSS via Location Selector Endpoint

Description

The plugin does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into following a crafted link (reflected XSS).

Proof of Concept

Affects Plugins

Plugin icon
real-estate-listing-realtyna-wpl
Fixed in 5.4.2

References

CVE
CVE-2026-91014

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Artus KG
Submitter
Artus KG
Submitter twitter
artuskg
Verified
Yes
WPVDB ID
a57a9fbd-6f77-463f-a9fa-79503c12a49c

Timeline

Publicly Published
2026-09-15 (about 2 days ago)
Added
2026-09-15 (about 1 day ago)
Last Updated
2026-09-15 (about 1 day ago)

Other

Published
Title
Published
2021-07-18
Title
Photo Gallery < 1.5.75 - Stored Cross-Site Scripting via Uploaded SVG
Published
2023-06-03
Title
Don8 <= 0.4 - Admin+ Stored XSS
Published
2023-12-27
Title
Product Code for WooCommerce < 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-01-16
Title
Display custom fields in the frontend – Post and User Profile Fields < 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via vg_display_data
Published
2023-10-18
Title
Comment Reply Email < 1.0.4 - Admin+ Stored XSS