PT-2026-99506 · WordPress · Optima Express Idx
CVSS v3.1
6.8
Medium
| Vector | AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Optima Express IDX WordPress plugin versions prior to 8.7.6
Description
Stored Cross-Site Scripting occurs because the plugin fails to properly neutralize script values submitted through a REST endpoint. These values are stored and subsequently echoed into the document head when a post is rendered, allowing users with author-level permissions to execute malicious scripts.
Recommendations
Update the plugin to version 8.7.6 or later.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Optima Express Idx