CVE-2025-0863

The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'idxframe' shortcode in all versions up to, and including, 3.14.27 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-0863 Flexmls® IDX <= 3.14.27 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'idxframe' shortcode in all versions up to, and including, 3.14.27 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-0863

The CVE-2025-0863 entry concerns the Flexmls IDX Plugin for WordPress. It describes a Stored Cross-Site Scripting vulnerability in the idx_frame shortcode present in all versions up to 3.14.27, caused by insufficient input sanitization and output escaping of user-supplied attributes. Exploitation...

CVE-2025-0863: Improper Neutralization of Input During Web Page Generation

The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'idxframe' shortcode in all versions up to, and including, 3.14.27 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2025-10048

Name of the Vulnerable Software and Affected Versions Flexmls® IDX Plugin versions up to, and including, 3.14.27 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the 'idx frame' shortcode. Thi...

CVE-2024-32128

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Realtyna Realtyna Organic IDX plugin.This issue affects Realtyna Organic IDX plugin: from n/a through 4.14.4...

WordPress Flexmls® IDX Plugin plugin <= 3.14.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via API parameters vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via API parameters vulnerability discovered by 1337Wannabe in WordPress Plugin Flexmls® IDX versions = 3.14.26...

CVE-2024-10552

The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘apikey’ and 'apisecret' parameters in all versions up to, and including, 3.14.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-10552 Flexmls® IDX Plugin <= 3.14.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via API parameters

The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘apikey’ and 'apisecret' parameters in all versions up to, and including, 3.14.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-10552 Flexmls® IDX Plugin <= 3.14.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via API parameters

The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘apikey’ and 'apisecret' parameters in all versions up to, and including, 3.14.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-10552

The CVE-2024-10552 entry concerns the Flexmls IDX Plugin for WordPress, with a Stored Cross-Site Scripting (XSS) vulnerability in the api_key and api_secret parameters present in all versions up to 3.14.26. The root cause is insufficient input sanitization and output escaping, enabling authentica...

WordPress plugin Flexmls IDX Plugin 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerabili...

PT-2025-1593 · Unknown · Flexmls Idx Plugin

Name of the Vulnerable Software and Affected Versions: Flexmls® IDX Plugin versions up to, and including, 3.14.26 Description: The issue is related to Stored Cross-Site Scripting via the api key and api secret parameters due to insufficient input sanitization and output escaping. This allows...

CVE-2024-10552: Improper Neutralization of Input During Web Page Generation

The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘apikey’ and 'apisecret' parameters in all versions up to, and including, 3.14.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-56013 WordPress Wovax IDX plugin <= 1.2.2 - Account Takeover vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in Wovax, LLC. Wovax IDX allows Authentication Bypass.This issue affects Wovax IDX: from n/a through 1.2.2...

CVE-2024-56013

CVE-2024-56013 affects Wovax IDX where an Authentication Bypass via an alternate path/channel is possible. Reported vulnerability score CVSS 3.1 base 8.8 (HIGH) with NETWORK attack vector, LOW privileges required, no user interaction, and impact to confidentiality, integrity, and availability all...

CVE-2024-11723

The kvCORE IDX plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via any parameter on pages with the kvcoreidxlistingssitemapranges, kvcoreidxlistingssitemappage, kvcoreidxagentprofilesitemap, or kvcoreidxagentprofile shortcode present in all versions up to, and including, 2.3....

CVE-2024-11723

The CVE CVE-2024-11723 affects the kvCORE IDX plugin for WordPress. It enables Reflected Cross‑Site Scripting via any parameter on pages that render kvcoreidx_listings_sitemap_ranges, kvcoreidx_listings_sitemap_page, kvcoreidx_agent_profile_sitemap, or kvcoreidx_agent_profile shortcodes, on all v...

CVE-2024-11723 kvCORE IDX <= 2.3.35 - Reflected Cross-Site Scripting

The kvCORE IDX plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via any parameter on pages with the kvcoreidxlistingssitemapranges, kvcoreidxlistingssitemappage, kvcoreidxagentprofilesitemap, or kvcoreidxagentprofile shortcode present in all versions up to, and including, 2.3....

CVE-2024-11723 kvCORE IDX <= 2.3.35 - Reflected Cross-Site Scripting

The kvCORE IDX plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via any parameter on pages with the kvcoreidxlistingssitemapranges, kvcoreidxlistingssitemappage, kvcoreidxagentprofilesitemap, or kvcoreidxagentprofile shortcode present in all versions up to, and including, 2.3....