Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Optima Express IDX 8.7.6 Clear all filters
TI-2026-63923 CVE-2026-96899 · GHSA-xprw-377p-8v85

Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script

Priority LOW 31

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is render…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00229 Published 2026-09-27 Fixed in 8.7.6 CWE-79
TI-2026-63921 CVE-2026-96897 · GHSA-fx75-253r-968v

Missing authorization in Optima Express IDX

Priority LOW 29

The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00182 Published 2026-09-27 Fixed in 8.7.6 CWE-862