CVE-2026-54869

6.5Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required
Impact: Limited impact
Weakness: CWE-79

Impact

Authenticated attackers can inject malicious scripts that execute in the context of other users or admins viewing the page. This requires network access to the site, an authenticated account with low privileges, and user interaction to view the injected content.

Root cause

The plugin fails to sanitize user input before storing it and rendering it into web pages, enabling stored cross-site scripting.

Affected systems

IMPress for IDX Broker (idx-broker-platinum) through 3.3.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Fix & remediation

Upgrade to a version newer than 3.3.1 if available. If no patched version exists or you cannot update immediately, deactivate and uninstall the idx-broker-platinum plugin.

shell

$ wp plugin update idx-broker-platinum || wp plugin deactivate idx-broker-platinum

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored XSS.This issue affects IMPress for IDX Broker: from n/a through 3.3.1.

References

https://patchstack.com/database/wordpress/plugin/idx-broker-platinum/vulnerability/wordpress-impress-for-idx-broker-plugin-3-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-54869