CVE-2026-78261

HighCVSS 7.1

Published: 27/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 27/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

Unauthenticated XSS vulnerability in Realtyna Organic IDX plugin versions up to 5.4.1. An attacker can inject malicious script that executes in the victim's browser.

Risk Assessment

Risk of session theft, account takeover, or malware distribution.

Recommendation

Update the Realtyna Organic IDX plugin to the latest version. Additionally, apply input filtering and output encoding.

Other vulnerabilities in Realtyna Organic IDX

CVE-2026-16236High
The Realtyna Organic IDX plugin for WordPress up to version 5.3.0 is vulnerable to arbitrary file upload due to missing file validation and insufficient authorization. Authenticated attackers with subscriber-level access can upload arbitrary files, potentially leading to remote code execution.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Realtyna Organic IDX plugin <= 5.4.1 versions.