The Flexmls® IDX Plugin for WordPress allows an authenticated user with contributor or higher privileges to insert arbitrary JavaScript into pages through the idx_frame shortcode. The plugin fails to sanitize or escape user‑supplied attributes, enabling a stored cross‑site scripting vulnerability that will execute in the browser context of any visitor to the affected page. This can lead to session hijacking, defacement, or theft of visitor data.

All installations of the Flexmls® IDX Plugin with a version of 3.14.27 or older are affected. The vulnerability exists in every release up to and including 3.14.27.

The CVSS base score of 6.4 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalog. An attacker must first be authenticated and possess at least contributor role privileges to inject the malicious script. Once injected, the script runs automatically whenever a page containing the idx_frame shortcode is viewed, potentially compromising all users who access those pages.