Stored Cross-Site Scripting in SimplyRETS Real Estate IDX Plugin for WordPress

CVE-2024-12491

What is CVE-2024-12491?

The SimplyRETS Real Estate IDX plugin for WordPress contains a vulnerability that allows authenticated attackers with contributor-level access or higher to exploit insufficient input sanitization and output escaping in the 'sr_search_form' shortcode. This results in the ability to inject arbitrary web scripts into pages. Once these scripts are embedded, they can execute whenever a user visits the affected page, creating significant security risks for users and site owners alike, as malicious scripts can compromise user data and site integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References