Reflected XSS Vulnerability in Realtyna Organic IDX and WPL Real Estate Plugins
CVE-2026-91014
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 17 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-91014?
The Realtyna Organic IDX plugin and WPL Real Estate plugin prior to version 5.4.2 exhibit a serious flaw where certain parameters are not properly sanitized or escaped. This lack of validation enables unauthenticated attackers to inject arbitrary web scripts into a visitor's browser. If a user is misled into clicking a specially crafted link, the attacker can execute scripts in the context of that user's session, leading to potential data theft or further exploitation.
Affected Version(s)
Realtyna Organic IDX plugin + WPL Real Estate 0 < 5.4.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.