High severity7.1NVD Advisory· Published Sep 17, 2026· Updated Sep 18, 2026
CVE-2026-91014
CVE-2026-91014
Description
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into following a crafted link (reflected XSS).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <5.4.2
Patches
Vulnerability mechanics
References
1News mentions
1- Wordfence Intelligence Weekly WordPress Vulnerability Report (September 14, 2026 to September 20, 2026)Wordfence Blog · Sep 24, 2026