Optima Express IDX vulnerabilities

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site Scripting attacks.

The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password on any connected install.

The Optima Express IDX plugin for WordPress (versions up to and including 8.7.5) is vulnerable to privilege escalation. The provisionBlogCredentials() function is reachable via the wp_ajax_nopriv_ihf_clear_cache AJAX action without capability checks, nonce verification, or ownership validation, and unconditionally sets the 'author' role for the account with login 'optima-express'. An unauthenticated attacker can register that username (if open registration is enabled) and gain author privileges.