CVE-2026-105066

HighCVSS 7.1

Published: 14/10/2026(UTC)Updated: 15/10/2026(UTC)Translated: 15/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

15th percentile - higher than 15% of all known CVEs

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS. This issue affects SimplyRETS Real Estate IDX: from n/a through 3.2.9.

Risk Assessment

An attacker can inject malicious script into a victim's browser, potentially leading to session theft, redirects, or page content modification. The risk affects users of sites with the vulnerable plugin installed.

Recommendation

Upgrade the SimplyRETS Real Estate IDX plugin to a version later than 3.2.9 that contains the fix. Until then, consider disabling the plugin.

Other vulnerabilities in SimplyRETS Real Estate IDX

CVE-2026-73354High
Unauthenticated Cross Site Scripting (XSS) in SimplyRETS Real Estate IDX <= 3.2.8 versions.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through 3.2.9.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS