Veille CVE

Recherche « Unknown Optima Express IDX »

2 CVE

Critique 0 Élevée 0 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Optima Express IDX » ✕
  1. CVE-2026-96899 6.8 Moyenne

    Unknown Optima Express IDX

    The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site Scripting attacks.

  2. CVE-2026-96897 5.3 Moyenne

    Unknown Optima Express IDX

    The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password on any connected install.