Advisories · Technology

Realtyna Organic IDX plugin + WPL Real Estate.

Every CVE that names Realtyna Organic IDX plugin + WPL Real Estate among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-91014 CVE record

CVSS 7.1 High

Realtyna Organic IDX plugin + WPL Real Estate < 5.4.2 - Reflected XSS via Location Selector Endpoint
- Realtyna Organic IDX plugin + WPL Real Estate
- Cross-site scripting (XSS)
Not analysed yet 17 Sept 2026
CVE-2026-16236 CVE record

CVSS 8.8 High

Realtyna Organic IDX plugin + WPL Real Estate <= 5.3.0 - Authenticated (Subscriber+) Arbitrary File Upload
- Realtyna Organic IDX plugin + WPL Real Estate
- Unrestricted file upload
Not analysed yet 31 Jul 2026
CVE-2026-14483 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Arbitrary File Upload via 'files[file]' Parameter via Public I/O 'set_property' Command
- Realtyna Organic IDX plugin + WPL Real Estate
- Unrestricted file upload
Not analysed yet 31 Jul 2026
CVE-2026-13714 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution
- Realtyna Organic IDX plugin + WPL Real Estate
- Unrestricted file upload
Not analysed yet 27 Jul 2026