The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin is vulnerable to a reflected cross-site scripting attack that allows unauthenticated remote code execution within a visitor's browser session.

This is a reflected cross-site scripting (CWE-79) vulnerability occurring because the plugin fails to sanitize or escape user-supplied parameters before reflecting them in the page. An unauthenticated attacker can exploit this by tricking a victim into clicking a malicious link.

The vulnerability carries a CVSS score of 7.1, indicating a high severity risk. Successful exploitation allows attackers to steal session cookies, redirect users to malicious sites, or perform unauthorized actions on behalf of the victim within the WordPress environment, leading to potential account takeover or data theft.

Immediate Action: Update the Realtyna Organic IDX plugin + WPL Real Estate to version 5.4.2 or later immediately.

Proactive Monitoring: Monitor web server access logs for suspicious URL parameters containing script tags or encoded characters that deviate from expected site traffic patterns.

Compensating Controls: Implement a robust Content Security Policy (CSP) and deploy a Web Application Firewall (WAF) configured to detect and block common XSS attack patterns in incoming HTTP requests.

Public Exploit Available: No (exploit_available is false; no confirmed public exploit exists in the provided data).

Given the potential for session hijacking and user impersonation via reflected XSS, administrators should prioritize updating the Realtyna Organic IDX plugin to version 5.4.2. Failure to remediate this flaw exposes site visitors to significant risk of credential theft and browser-based attacks. Apply the update as soon as possible to ensure the security of your WordPress installation.