Stored Cross-Site Scripting Vulnerability in Optima Express IDX WordPress Plugin
CVE-2026-96899
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 27 September 2026
Badges
What is CVE-2026-96899?
The Optima Express IDX WordPress plugin versions prior to 8.7.6 are vulnerable due to inadequate sanitization of script values submitted via its REST endpoints. This oversight potentially allows users with even minimal permissions, such as authors, to execute Stored Cross-Site Scripting (XSS) attacks. When affected posts are rendered, the unsanitized script content may get echoed into the document head, compromising the security of the website and its users. It is crucial for users and administrators to promptly update the plugin to mitigate this risk.
Affected Version(s)
Optima Express IDX 8.6.0 < 8.7.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.