Stored Cross-Site Scripting in SimplyRETS Real Estate IDX Plugin for WordPress

CVE-2024-12491

What is CVE-2024-12491?

The SimplyRETS Real Estate IDX plugin for WordPress contains a vulnerability that allows authenticated attackers with contributor-level access or higher to exploit insufficient input sanitization and output escaping in the 'sr_search_form' shortcode. This results in the ability to inject arbitrary web scripts into pages. Once these scripts are embedded, they can execute whenever a user visits the affected page, creating significant security risks for users and site owners alike, as malicious scripts can compromise user data and site integrity.

References