What is GHSA-qm73-3q75-wf7w?

GHSA-qm73-3q75-wf7w is a security advisory published by GitHub Security Advisories with High severity. The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise...

Which CVE IDs does GHSA-qm73-3q75-wf7w cover?

GHSA-qm73-3q75-wf7w covers the following CVE IDs: CVE-2026-91014. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qm73-3q75-wf7w?

GHSA-qm73-3q75-wf7w has a CVSS v3 base score of 7.1, published by GitHub Security Advisories.

GHSA-qm73-3q75-wf7wHighCVSS 7.1

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise...

Vendor

GitHub Security Advisories

Published

September 17, 2026

Last Modified

September 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-91014 →

📋 Description

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into following a crafted link (reflected XSS).

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-91014
https://wpscan.com/vulnerability/a57a9fbd-6f77-463f-a9fa-79503c12a49c
https://github.com/advisories/GHSA-qm73-3q75-wf7w