Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-91014— Realtyna Organic IDX plugin + WPL Real Estate < 5.4.2 - Reflected XSS via Location Selector Endpoint

Quick assessment

Affected
Unknown Realtyna Organic IDX plugin + WPL Real Estate
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Realtyna Organic IDX 插件和 WPL Real Estate WordPress 插件在 5.4.2 版本之前，未对其部分参数进行适当的净化（sanitise）和转义（escape），导致这些参数在返回到页面时直接输出，从而允许未认证的攻击者通过诱导访客点击特制的链接，在访客的浏览器中执行任意 Web 脚本（即反射型跨站脚本攻击，Reflected XSS）。

AI Predicted 6.1 Difficulty: Easy EPSS 0.28% · P21

Possible ATT&CK Techniques 1 AI

T1189 · Drive-by Compromise

Affected Version Matrix 1

VendorProduct Version RangeStatus
Unknown Realtyna Organic IDX plugin + WPL Real Estate < 5.4.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-91014

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Realtyna Organic IDX plugin + WPL Real Estate < 5.4.2 - Reflected XSS via Location Selector Endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into following a crafted link (reflected XSS).
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown Realtyna Organic IDX plugin + WPL Real Estate 0 ~ 5.4.2 -

II. Public POCs for CVE-2026-91014

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-91014

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-91014 (1)

Same Patch Batch · Unknown · 2026-09-17 · 29 CVEs total

CVE-2026-86801 8.8 HIGH To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, File Listing and Deletion via Un
CVE-2026-87963 8.6 HIGH Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter
CVE-2026-87829 4.3 MEDIUM Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Unvalidated
CVE-2026-87831 4.3 MEDIUM Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Customer Ad
CVE-2026-91017 3.7 LOW Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via For
CVE-2026-90922 Paid Member Subscriptions < 3.0.9 - Unauthenticated Membership Payment Bypass via PayPal S
CVE-2026-91015 Master Addons for Elementor < 3.1.9 - Unauthenticated Popup Deactivation via jltma_popup_d
CVE-2026-91016 Motors < 1.4.121 - Unauthenticated Draft/Private Listing Disclosure
CVE-2026-91019 Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential Di
CVE-2026-90923 Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and De
CVE-2026-91008 Event Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure vi
CVE-2026-91011 EWWW Image Optimizer < 8.7.7 - Author+ Stored XSS via Image Class Attribute Backreference
CVE-2026-91010 Invisible Anti-Spam & CAPTCHA < 5.1.1 - Subscriber+ Arbitrary Form Submission Deletion
CVE-2026-91009 Active Products Tables for WooCommerce < 2.1.3 - Subscriber+ Arbitrary Post Title Modifica
CVE-2026-85128 Choose User Role at Registration for WooCommerce < 1.3.3 - Unauthenticated Privilege Escal
CVE-2026-88792 Dictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Update
CVE-2026-88795 wpShopGermany IT-RECHT KANZLEI < 2.4 - Unauthenticated RCE via Predictable API Token
CVE-2026-88904 PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privi
CVE-2026-87836 Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export
CVE-2026-87786 Dewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout Coordinates

Showing top 20 of 29 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Realtyna Organic IDX plugin + WPL Real Estate
Same vendor: Unknown