vulnerability

WordPress Plugin: idx-broker-platinum: CVE-2020-11512: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Severity
3
CVSS
(AV:N/AC:M/Au:S/C:N/I:P/A:N)
Published
Mar 26, 2020
Added
May 15, 2025
Modified
May 15, 2025

Description

Stored XSS in the IMPress for IDX Broker WordPress plugin before 2.6.2 allows authenticated attackers with minimal (subscriber-level) permissions to save arbitrary JavaScript in the plugin's settings panel via the idx_update_recaptcha_key AJAX action and a crafted idx_recaptcha_site_key parameter, which would then be executed in the browser of any administrator visiting the panel. This could be used to create new administrator-level accounts.

Solution

idx-broker-platinum-plugin-cve-2020-11512
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.