Vulnerabilities

TI-2026-20487 CVE-2026-25369 · GHSA-g23c-v634-9ffv

WordPress Flexmls® IDX plugin <= 3.15.9 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flexmls Flexmls® IDX flexmls-idx allows Reflected XSS.This issue affects Flexmls® IDX: from n/a through <= 3.15.9.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00155 Published 2026-03-16 No fix listed CWE-79

TI-2025-41339 CVE-2025-67585 · GHSA-v3p3-x59h-hh4x

WordPress Flexmls® IDX plugin <= 3.15.7 - Open Redirection vulnerability

LOW 21

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in flexmls Flexmls® IDX flexmls-idx allows Phishing.This issue affects Flexmls® IDX: from n/a through <= 3.15.7.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00196 Published 2025-12-09 No fix listed CWE-601

TI-2025-00731 CVE-2025-0863 · GHSA-256m-jmr2-59pc

Flexmls® IDX <= 3.14.27 - Authenticated (Contributor+) Stored Cross-Site Scripting

LOW 28

The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'idx_frame' shortcode in all versions up to, and including, 3.14.27 due to insufficient input sanitization and ou…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00312 Published 2025-03-07 No fix listed CWE-79

TI-2025-19771 CVE-2025-26900 · GHSA-xw96-38mm-h5jg

WordPress Flexmls® IDX Plugin Plugin <= 3.14.27 - PHP Object Injection vulnerability

MEDIUM 43

Deserialization of Untrusted Data vulnerability in flexmls Flexmls® IDX flexmls-idx allows Object Injection.This issue affects Flexmls® IDX: from n/a through <= 3.14.27.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00603 Published 2025-02-25 No fix listed CWE-502

TI-2024-09775 CVE-2024-10552 · GHSA-4xh3-594p-88cm

Flexmls® IDX Plugin <= 3.14.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via API parameters

LOW 28

The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘api_key’ and 'api_secret' parameters in all versions up to, and including, 3.14.26 due to insufficient input sanitization…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00326 Published 2025-01-25 No fix listed CWE-79

TI-2024-08088 CVE-2024-8719 · GHSA-9pxc-g2q3-vqwv

Flexmls® IDX Plugin <= 3.14.22 - Reflected Cross-Site Scripting

LOW 27

The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters like 'MaxBeds' and 'MinBeds' in all versions up to, and including, 3.14.22 due to insufficient input san…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00317 Published 2024-10-17 No fix listed CWE-79