The FlexIDX Home Search plugin contains an improper neutralization of input vulnerability that permits attackers to inject malicious scripts that persist across page loads. When a user who is not an administrator visits a page rendering stored input, the attacker’s script runs with the privileges of that browser session. This can lead to theft of session cookies, credential hijacking, or the execution of arbitrary code within the victim’s context.

WordPress sites using the Max Chirkov FlexIDX Home Search plugin version 2.1.2 or earlier are affected. No other products or versions are noted to be vulnerable.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score of less than 1% suggests a low exploitation probability under current conditions. Because it is not listed in CISA KEV, there have been no confirmed public exploits at the time of this report. The likely attack vector is through a web form or admin interface that accepts untrusted input, and the vulnerability is stored in the database, making it persistent. Attackers would need to inject a payload into a field that is later displayed without encoding.