This vulnerability is a stored cross‑site scripting flaw that occurs when input entered in the IDX Broker IMPress for IDX Broker plugin is not properly neutralized during web page generation. An attacker who can supply crafted input that the plugin stores in the database can later cause arbitrary scripts to run in the browsers of users who view affected pages, potentially leading to session hijacking, theft of credentials, or defacement.

The defect is present in the IDX Broker IMPress for IDX Broker plugin for all releases up to and including version 3.3.1. Users running any of these versions are potentially exposed.

The CVSS score of 6.5 indicates moderate severity. No EPSS score is listed in the CISA KEV catalog. Attack exploitation requires an attacker to inject malicious input via a writable interface of the plugin; if successful, the victim can be tricked into viewing an affected page and executing the attacker’s script. The risk remains for all sites that host the vulnerable plugin without a mitigated version.