Stored Cross-Site Scripting in Flexmls IDX Plugin for WordPress

CVE-2024-10552

Summary

The Flexmls IDX Plugin for WordPress contains a vulnerability that allows authenticated users with Contributor-level access or higher to perform Stored Cross-Site Scripting attacks. This occurs through improperly sanitized input in the 'api_key' and 'api_secret' parameters, enabling attackers to inject malicious scripts. These scripts execute when users visit affected pages. Although a partial patch was applied in version 3.14.25, the vulnerability persists in all versions up to 3.14.26, posing a risk to site integrity and user data.

References