CVE-2026-54869: WordPress IMPress for IDX Broker plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability
Published Oct 13, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored XSS.This issue affects IMPress for IDX Broker: from n/a through 3.3.1.
Affected Software
1 affected component
IDX Broker IMPress for IDX Broker<=3.3.1
Event History
Oct 13, 2026
CVE Published
via MITRE·05:49 AM
Data Sourced
via MITRE·05:49 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which versions should be treated as affected?
IMPress for IDX Broker versions through 3.3.1 are affected. The available data does not identify a fixed version.
2
What access does an attacker need to exploit this issue?
The CVSS vector indicates network access, low privileges, and user interaction are required. This is not described as an unauthenticated, no-interaction attack.
3
What is the expected impact if exploitation succeeds?
The issue is stored XSS with low confidentiality, integrity, and availability impact. The CVSS vector also indicates scope can change, meaning impact may extend beyond the vulnerable component's original security authority.