CVE-2026-96899

Name of the Vulnerable Software and Affected Versions Optima Express IDX WordPress plugin versions prior to 8.7.6

Description Stored Cross-Site Scripting occurs because the plugin fails to properly neutralize script values submitted through a REST endpoint. These values are stored and subsequently echoed into the document head when a post is rendered, allowing users with author-level permissions to execute malicious scripts.

Recommendations Update the plugin to version 8.7.6 or later.