25 matches found
CVE-2026-96899
The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site...
CVE-2026-96897
The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password...
EUVD-2026-87901
The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site...
EUVD-2026-87900
The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password...
CVE-2026-96899 Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script
The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site...
CVE-2026-96897 Optima Express 8.5.0 - 8.7.5 - Unauthenticated Author Account Creation & Application Password Rotation via ihf_clear_cache
The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password...
CVE-2026-96897
The Optima Express IDX WordPress plugin (versions 8.5.0 - 8.7.5 ) is vulnerable to an authentication bypass due to a missing authorization check on an AJAX action. This flaw allows unauthenticated attackers to force the creation of a fixed author-role account and repeatedly rotate its application...
CVE-2026-96899
The Optima Express IDX WordPress plugin (versions 8.6.0 - 8.7.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw occurs because the plugin fails to properly neutralise a script value submitted via a REST endpoint before storing it and subsequently echoing it into the document head ...
CVE-2026-93901
The Optima Express IDX plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 8.7.5. This is due to the provisionBlogCredentials function in iHomefinderAdmin.php being reachable via the wpajaxnoprivihfclearcache AJAX action — through the call chain...
EUVD-2026-86601
The Optima Express IDX plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 8.7.5. This is due to the provisionBlogCredentials function in iHomefinderAdmin.php being reachable via the wpajaxnoprivihfclearcache AJAX action — through the call chain...
CVE-2026-93901 Optima Express IDX <= 8.7.5 - Unauthenticated Privilege Escalation to 'ihf_clear_cache' AJAX Action to Author Role Assignment
The Optima Express IDX plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 8.7.5. This is due to the provisionBlogCredentials function in iHomefinderAdmin.php being reachable via the wpajaxnoprivihfclearcache AJAX action — through the call chain...
CVE-2026-93901
The Optima Express IDX plugin for WordPress (versions
WordPress Optima Express IDX plugin <= 8.7.5 - Unauthenticated Privilege Escalation to 'ihf_clear_cache' AJAX Action to Author Role Assignment vulnerability
Unauthenticated Privilege Escalation to 'ihfclearcache' AJAX Action to Author Role Assignment vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Optima Express + MarketBoost IDX Plugin versions = 8.7.5...
EUVD-2023-35113
Malicious code in bioql PyPI...
CVE-2023-30749
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in ihomefinder Optima Express + MarketBoost IDX Plugin plugin = 7.3.0 versions...
Optima Express + MarketBoost IDX < 7.3.1 - Admin+ Stored XSS
Description The plugin does not validate and escape some parameters, which could allow users with the admin role and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2023-30749
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in ihomefinder Optima Express + MarketBoost IDX Plugin plugin = 7.3.0 versions...
CVE-2023-30749
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in ihomefinder Optima Express + MarketBoost IDX Plugin plugin = 7.3.0 versions...
