The Flexmls® IDX plugin for WordPress implements an open redirect flaw that allows a malicious actor to redirect users to a URL of their choosing. The vulnerability arises because the plugin accepts arbitrary redirect targets without validating them. As a result, attackers can craft links that appear to come from the legitimate site, leading to phishing or malicious downloads. This is a CWE‑601 type weakness.

The issue affects all installations of the Flexmls® IDX WordPress plugin from the earliest release up through version 3.15.7. Any WordPress site that has the plugin installed and is using a vulnerable version is at risk.

The CVSS base score of 4.7 indicates moderate severity. The EPSS score (<1%) shows a relatively low probability of exploitation at this time, and the vulnerability is not listed in CISA's KEV catalog. However, because an open redirect can be leveraged to deliver phishing content, the potential impact on user trust is significant. Exploitation requires only that a user click an attacker‑crafted link; no privileged access is needed. The attack vector is likely the web browser, as the vulnerability is triggered by a maliciously crafted URL processed by the plugin.