CVE-2026-91014 — Realtyna Organic IDX plugin + WPL Real Estate < 5.4.2 - Reflected XSS via Location Selector Endpoint

CVE-2026-91014

Realtyna Organic IDX plugin + WPL Real Estate < 5.4.2 - Reflected XSS via Location Selector Endpoint PUBLISHED

Description (CNA)

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into following a crafted link (reflected XSS).

Affected (CNA)

Vendor / product	Versions
Unknown / Realtyna Organic IDX plugin + WPL Real Estate	affected 0 before 5.4.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/a57a9fbd-6f77-463f-a9fa-79503c12a49c/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.