CVE-2026-96899
Low risk· EPSS 4%Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site Scripting attacks.
Risk Assessment
XSS attacks can lead to admin session hijacking, data theft, or content modification.
Recommendation
It is recommended to update the Optima Express IDX plugin to version 8.7.6 or later and restrict author role permissions.
Other vulnerabilities in Optima Express IDX
See all- CVE-2026-96897Low risk· EPSS 3%
The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password on any connected install.
- CVE-2026-93901High
The Optima Express IDX plugin for WordPress (versions up to and including 8.7.5) is vulnerable to privilege escalation. The provisionBlogCredentials() function is reachable via the wp_ajax_nopriv_ihf_clear_cache AJAX action without capability checks, nonce verification, or ownership validation, and unconditionally sets the 'author' role for the account with login 'optima-express'. An unauthenticated attacker can register that username (if open registration is enabled) and gain author privileges.
Original NVD description (English source)
The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site Scripting attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS