CVE-2026-105066: WordPress SimplyRETS Real Estate IDX plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through 3.2.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress SimplyRETS Real Estate IDX pluginto a version that resolves this vulnerability.Fixed in 3.3.0
Event History
Frequently Asked Questions
Which installations are affected?
SimplyRETS Real Estate IDX versions through 3.2.9 are affected. The available data does not identify a fixed version.
What does exploitation require?
The vulnerability is remotely reachable with low attack complexity and requires no attacker privileges, but it does require user interaction. Successful exploitation can affect confidentiality, integrity, and availability with scope changed.