# Flexmls® IDX Plugin <= 4.1.2 - Unauthenticated Reflected Cross-Site Scripting via IDX Search Widget Request URI

- **ID:** WPSEC-2026-3006
- **Plugin:** Flexmls® IDX Plugin (`flexmls-idx`), https://wordpress.org/plugins/flexmls-idx/
- **Affected versions:** all versions before 4.2
- **Fixed in:** 4.2 (Update to 4.2 or later.)
- **Severity:** Medium 4.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/flexmls-idx
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3006/

## Description

The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the request URI in the IDX Search widget in all versions up to, and including, 4.1.2. This is due to the widget printing $_SERVER['REQUEST_URI'] without escaping into the single-quoted action attribute of its search form when the widget's destination is set to remote. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can trick a user, such as an administrator, into clicking a crafted link to a page containing the IDX Search widget.

## References

- https://wpsec.com/vuln/WPSEC-2026-3006/
- https://plugins.svn.wordpress.org/flexmls-idx/tags/4.2/
- https://wordpress.org/plugins/flexmls-idx/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3006/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.