{
 "id": "WPSEC-2026-3005",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3005/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3005/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3005/index.md",
 "title": "Flexmls® IDX Plugin <= 4.1.2 - Unauthenticated Reflected Cross-Site Scripting via IDX Search Widget Location Parameters",
 "description": "The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the location query parameters (such as 'City', 'PostalCode' and 'SubdivisionName') of the IDX Search widget in all versions up to, and including, 4.1.2. This is due to insufficient input sanitization and output escaping: the values are read from the query string and printed into the selected location options' value attribute and text without escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can trick a user, such as an administrator, into clicking a crafted link to a page containing the IDX Search widget.",
 "plugin": {
  "slug": "flexmls-idx",
  "name": "Flexmls® IDX Plugin",
  "full_name": "Flexmls® IDX Plugin",
  "wordpress_org": "https://wordpress.org/plugins/flexmls-idx/",
  "advisories_url": "https://wpsec.com/vuln/plugin/flexmls-idx/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/flexmls-idx"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.7",
    "from_inclusive": true,
    "to": "4.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.7 before 4.2"
  ]
 },
 "introduced_in": "3.7",
 "fixed_in": "4.2",
 "remediation": "Update to 4.2 or later.",
 "fix_released": "2026-11-11T19:56:41+00:00",
 "published": "2026-11-12T20:47:03+00:00",
 "updated": "2026-11-12T17:11:24.560713+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3005/",
  "https://plugins.svn.wordpress.org/flexmls-idx/tags/4.2/",
  "https://wordpress.org/plugins/flexmls-idx/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/flexmls-idx",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}