CVE-2026-91014: Realtyna Organic IDX plugin + WPL Real Estate < 5.4.2 - Reflected XSS via Location Selector Endpoint
Published Sep 17, 2026
·Updated
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into following a crafted link (reflected XSS).
Affected Software
1 affected component
Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin<5.4.2
Event History
Sep 17, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue, and what user interaction is required?
An unauthenticated attacker can attempt exploitation without an account. They must persuade a visitor to follow a crafted link, which causes attacker-supplied script to run in that visitor's browser.
2
Which installations are affected?
The issue affects the Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before version 5.4.2.