This vulnerability is a reflected cross‑site scripting flaw caused by the SimplyRETS Real Estate IDX plugin’s failure to neutralize user‑supplied input. By inserting a crafted payload into an input field or URL that the plugin uses when rendering a page, an attacker can cause arbitrary JavaScript to execute in the browsers of site visitors. Such code can steal authentication cookies, hijack user sessions, deface content, or deliver malware, potentially impacting many users of a real‑estate website.

Any WordPress installation running the SimplyRETS Real Estate IDX plugin version 3.2.9 or earlier is affected. The plugin is available through the WordPress plugin repository and is commonly deployed on real‑estate or property listing sites.

The CVSS v3.1 score of 7.1 places this issue in the high‑severity range. The EPSS score of less than 1% indicates a very low public exploitation probability, and it is not listed in the CISA KEV catalog. An attacker can exploit the flaw without needing site credentials by crafting a malicious URL or input that the plugin incorporates into its output. The impact is confined to the victim’s browser, but it can affect large numbers of visitors if the site receives significant traffic.