Read the docs
TI-2014-03708 Aliases CVE-2014-4521GHSA-5mm2-4pw5-g3w5

Cross-site scripting (XSS) vulnerability in client-assist.php in the dsIDXpress IDX…

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Cross-site scripting (XSS) vulnerability in client-assist.php in the dsIDXpress IDX plugin before 2.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter.

Why it matters now

EPSS 0.01637 76th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 41

CPEVersionsRoleVendor
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:*:*:*:*:*:wordpress:*:*up to 2.1.0VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.0:*:*:*:*:wordpress:*:*2.0.0VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.1:*:*:*:*:wordpress:*:*2.0.1VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.2:*:*:*:*:wordpress:*:*2.0.2VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.3:*:*:*:*:wordpress:*:*2.0.3VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.4:*:*:*:*:wordpress:*:*2.0.4VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.5:*:*:*:*:wordpress:*:*2.0.5VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.6:*:*:*:*:wordpress:*:*2.0.6VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.7:*:*:*:*:wordpress:*:*2.0.7VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.8:*:*:*:*:wordpress:*:*2.0.8VulnerableDiversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:*:*:*:*:*:wordpress:*:* Versions up to 2.1.0 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.0:*:*:*:*:wordpress:*:* Versions 2.0.0 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.1:*:*:*:*:wordpress:*:* Versions 2.0.1 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.2:*:*:*:*:wordpress:*:* Versions 2.0.2 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.3:*:*:*:*:wordpress:*:* Versions 2.0.3 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.4:*:*:*:*:wordpress:*:* Versions 2.0.4 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.5:*:*:*:*:wordpress:*:* Versions 2.0.5 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.6:*:*:*:*:wordpress:*:* Versions 2.0.6 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.7:*:*:*:*:wordpress:*:* Versions 2.0.7 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.8:*:*:*:*:wordpress:*:* Versions 2.0.8 Vulnerable ·Diversesolutions
Show 31 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.9:*:*:*:*:wordpress:*:*2.0.9VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.10:*:*:*:*:wordpress:*:*2.0.10VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.11:*:*:*:*:wordpress:*:*2.0.11VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.12:*:*:*:*:wordpress:*:*2.0.12VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.13:*:*:*:*:wordpress:*:*2.0.13VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.14:*:*:*:*:wordpress:*:*2.0.14VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.15:*:*:*:*:wordpress:*:*2.0.15VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.16:*:*:*:*:wordpress:*:*2.0.16VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.17:*:*:*:*:wordpress:*:*2.0.17VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.18:*:*:*:*:wordpress:*:*2.0.18VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.19:*:*:*:*:wordpress:*:*2.0.19VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.20:*:*:*:*:wordpress:*:*2.0.20VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.21:*:*:*:*:wordpress:*:*2.0.21VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.22:*:*:*:*:wordpress:*:*2.0.22VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.23:*:*:*:*:wordpress:*:*2.0.23VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.24:*:*:*:*:wordpress:*:*2.0.24VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.25:*:*:*:*:wordpress:*:*2.0.25VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.26:*:*:*:*:wordpress:*:*2.0.26VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.27:*:*:*:*:wordpress:*:*2.0.27VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.28:*:*:*:*:wordpress:*:*2.0.28VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.29:*:*:*:*:wordpress:*:*2.0.29VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.30:*:*:*:*:wordpress:*:*2.0.30VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.31:*:*:*:*:wordpress:*:*2.0.31VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.32:*:*:*:*:wordpress:*:*2.0.32VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.33:*:*:*:*:wordpress:*:*2.0.33VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.34:*:*:*:*:wordpress:*:*2.0.34VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.35:*:*:*:*:wordpress:*:*2.0.35VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.36:*:*:*:*:wordpress:*:*2.0.36VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.37:*:*:*:*:wordpress:*:*2.0.37VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.38:*:*:*:*:wordpress:*:*2.0.38VulnerableDiversesolutions
cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.39:*:*:*:*:wordpress:*:*2.0.39VulnerableDiversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.9:*:*:*:*:wordpress:*:* Versions 2.0.9 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.10:*:*:*:*:wordpress:*:* Versions 2.0.10 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.11:*:*:*:*:wordpress:*:* Versions 2.0.11 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.12:*:*:*:*:wordpress:*:* Versions 2.0.12 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.13:*:*:*:*:wordpress:*:* Versions 2.0.13 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.14:*:*:*:*:wordpress:*:* Versions 2.0.14 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.15:*:*:*:*:wordpress:*:* Versions 2.0.15 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.16:*:*:*:*:wordpress:*:* Versions 2.0.16 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.17:*:*:*:*:wordpress:*:* Versions 2.0.17 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.18:*:*:*:*:wordpress:*:* Versions 2.0.18 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.19:*:*:*:*:wordpress:*:* Versions 2.0.19 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.20:*:*:*:*:wordpress:*:* Versions 2.0.20 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.21:*:*:*:*:wordpress:*:* Versions 2.0.21 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.22:*:*:*:*:wordpress:*:* Versions 2.0.22 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.23:*:*:*:*:wordpress:*:* Versions 2.0.23 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.24:*:*:*:*:wordpress:*:* Versions 2.0.24 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.25:*:*:*:*:wordpress:*:* Versions 2.0.25 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.26:*:*:*:*:wordpress:*:* Versions 2.0.26 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.27:*:*:*:*:wordpress:*:* Versions 2.0.27 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.28:*:*:*:*:wordpress:*:* Versions 2.0.28 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.29:*:*:*:*:wordpress:*:* Versions 2.0.29 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.30:*:*:*:*:wordpress:*:* Versions 2.0.30 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.31:*:*:*:*:wordpress:*:* Versions 2.0.31 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.32:*:*:*:*:wordpress:*:* Versions 2.0.32 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.33:*:*:*:*:wordpress:*:* Versions 2.0.33 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.34:*:*:*:*:wordpress:*:* Versions 2.0.34 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.35:*:*:*:*:wordpress:*:* Versions 2.0.35 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.36:*:*:*:*:wordpress:*:* Versions 2.0.36 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.37:*:*:*:*:wordpress:*:* Versions 2.0.37 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.38:*:*:*:*:wordpress:*:* Versions 2.0.38 Vulnerable ·Diversesolutions
  • cpe:2.3:a:diversesolutions:dsidxpress_idx_plugin:2.0.39:*:*:*:*:wordpress:*:* Versions 2.0.39 Vulnerable ·Diversesolutions

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-4521
  2. 2026-10-03 Alias added: GHSA-5mm2-4pw5-g3w5

References

Exploit 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences