CVE-2024-10552

The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘apikey’ and 'apisecret' parameters in all versions up to, and including, 3.14.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-10552 Flexmls® IDX Plugin <= 3.14.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via API parameters

The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘apikey’ and 'apisecret' parameters in all versions up to, and including, 3.14.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-10552 Flexmls® IDX Plugin <= 3.14.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via API parameters

The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘apikey’ and 'apisecret' parameters in all versions up to, and including, 3.14.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-10552

The CVE-2024-10552 entry concerns the Flexmls IDX Plugin for WordPress, with a Stored Cross-Site Scripting (XSS) vulnerability in the api_key and api_secret parameters present in all versions up to 3.14.26. The root cause is insufficient input sanitization and output escaping, enabling authentica...

WordPress plugin Flexmls IDX Plugin 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerabili...

PT-2025-1593 · Unknown · Flexmls Idx Plugin

Name of the Vulnerable Software and Affected Versions: Flexmls® IDX Plugin versions up to, and including, 3.14.26 Description: The issue is related to Stored Cross-Site Scripting via the api key and api secret parameters due to insufficient input sanitization and output escaping. This allows...

CVE-2024-56013

CVE-2024-56013 affects Wovax IDX where an Authentication Bypass via an alternate path/channel is possible. Reported vulnerability score CVSS 3.1 base 8.8 (HIGH) with NETWORK attack vector, LOW privileges required, no user interaction, and impact to confidentiality, integrity, and availability all...

CVE-2024-56013 WordPress Wovax IDX plugin <= 1.2.2 - Account Takeover vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in Wovax, LLC. Wovax IDX allows Authentication Bypass.This issue affects Wovax IDX: from n/a through 1.2.2...

CVE-2024-11723

The kvCORE IDX plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via any parameter on pages with the kvcoreidxlistingssitemapranges, kvcoreidxlistingssitemappage, kvcoreidxagentprofilesitemap, or kvcoreidxagentprofile shortcode present in all versions up to, and including, 2.3....

CVE-2024-11723 kvCORE IDX <= 2.3.35 - Reflected Cross-Site Scripting

The kvCORE IDX plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via any parameter on pages with the kvcoreidxlistingssitemapranges, kvcoreidxlistingssitemappage, kvcoreidxagentprofilesitemap, or kvcoreidxagentprofile shortcode present in all versions up to, and including, 2.3....

CVE-2024-11723 kvCORE IDX <= 2.3.35 - Reflected Cross-Site Scripting

The kvCORE IDX plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via any parameter on pages with the kvcoreidxlistingssitemapranges, kvcoreidxlistingssitemappage, kvcoreidxagentprofilesitemap, or kvcoreidxagentprofile shortcode present in all versions up to, and including, 2.3....

CVE-2024-11723

The CVE CVE-2024-11723 affects the kvCORE IDX plugin for WordPress. It enables Reflected Cross‑Site Scripting via any parameter on pages that render kvcoreidx_listings_sitemap_ranges, kvcoreidx_listings_sitemap_page, kvcoreidx_agent_profile_sitemap, or kvcoreidx_agent_profile shortcodes, on all v...

CVE-2024-10003

The Rover IDX plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 3.0.0.2903. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2024-10002

The Rover IDX plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0.0.2905. This is due to insufficient validation and capability check on the 'roveridxrefreshsocialcallback' function. This makes it possible for authenticated attackers, with...

CVE-2024-10003

CVE-2024-10003 (Rover IDX for WordPress) affects Rover IDX plugin, versions up to 3.0.0.2903. Root cause is a missing capability check on multiple functions, enabling authenticated attackers with subscriber-level access or higher to add, modify, or delete plugin options, potentially leading to un...

PT-2024-15968 · WordPress · Rover Idx Plugin

Name of the Vulnerable Software and Affected Versions: Rover IDX plugin for WordPress versions up to, and including, 3.0.0.2903 Description: The issue allows unauthorized access, modification, and loss of data due to a missing capability check on multiple functions. This makes it possible for...

WordPress plugin Rover IDX 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress Rover IDX plugin <= 3.0.0.2903 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions vulnerability

Authenticated Subscriber+ Missing Authorization via Multiple Functions vulnerability discovered by István Márton in WordPress Plugin Rover IDX versions = 3.0.0.2903...

PT-2024-15967 · WordPress · Rover Idx Plugin

Name of the Vulnerable Software and Affected Versions: Rover IDX plugin for WordPress versions up to and including 3.0.0.2905 Description: The issue arises from insufficient validation and capability check on the rover idx refresh social callback function, allowing authenticated attackers with...

CVE-2024-8719

The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters like 'MaxBeds' and 'MinBeds' in all versions up to, and including, 3.14.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...