Is CVE-2026-91014 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91014 being exploited in the wild.

How severe is CVE-2026-91014?

High severity, with a CVSS score of 7.1, published 17 September 2026.

Which products and versions are affected?

Realtyna Organic IDX + WPL Real Estate before 5.4.2.

Is there a fix for CVE-2026-91014?

A patch was published on 2026-09-15: Fixed in version 5.4.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-91014 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-91014?

Check whether you run Realtyna Organic IDX + WPL Real Estate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91014: Realtyna Organic IDX + WPL Real Estate reflected XSS in location selector

CVE-2026-91014 · Severity: high · CVSS 7.1 · Published 2026-09-17

The Realtyna Organic IDX + WPL Real Estate WordPress plugin is used to display and manage real estate listings on websites. A reflected cross-site scripting (XSS) vulnerability allows attackers to inject malicious scripts that execute in visitors' browsers when they click a crafted link, potentially compromising visitor data, hijacking sessions, or redirecting users to malicious sites.

Vendors: Realtyna.

Quick answers

Is CVE-2026-91014 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91014 being exploited in the wild.
How severe is CVE-2026-91014?: High severity, with a CVSS score of 7.1, published 17 September 2026.
Which products and versions are affected?: Realtyna Organic IDX + WPL Real Estate before 5.4.2.
Is there a fix for CVE-2026-91014?: A patch was published on 2026-09-15: Fixed in version 5.4.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-91014 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-91014?: Check whether you run Realtyna Organic IDX + WPL Real Estate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin fails to properly sanitize and escape parameters before reflecting them back in HTTP responses, creating a reflected XSS vulnerability in the location selector endpoint. An unauthenticated attacker can craft a malicious URL containing JavaScript payloads that will execute in a victim's browser when the link is visited. No authentication is required to exploit this vulnerability. The vendor has released a patch in version 5.4.2 that sanitizes and escapes the vulnerable parameters.

Affected products

Realtyna Organic IDX + WPL Real Estate before 5.4.2

Timeline

2026-09-15: disclosed
2026-09-15: patched: Fixed in version 5.4.2

References

https://wpscan.com/vulnerability/a57a9fbd-6f77-463f-a9fa-79503c12a49c/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.