CVE-2026-73354: WordPress SimplyRETS Real Estate IDX plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in SimplyRETS Real Estate IDX <= 3.2.8 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress SimplyRETS Real Estate IDX pluginto a version that resolves this vulnerability.Fixed in 3.2.9
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The vulnerability is unauthenticated and network-reachable, so an attacker does not need a WordPress account or other prior privileges. Exploitation requires user interaction, meaning a victim must be induced to view or interact with attacker-controlled content.
What impact could successful exploitation have?
The supplied vector indicates scope can extend beyond the vulnerable component and that confidentiality, integrity, and availability impacts are each rated low. As an XSS issue, successful exploitation could run script in a victim's browser in the context of the affected site.
Which installations should be treated as affected?
Installations using the SimplyRETS Real Estate IDX WordPress plugin at version 3.2.8 or earlier should be treated as affected. The provided data does not identify a fixed version or any configuration prerequisites.