Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?EstateEssential Real EstateRealtyna Organic IDXReal Estate ManagerReal Estate 7Estatik Real EstateSimplyRETS Real Estate IDXReal Estate Manager Pro
Plugin · real-estate-listing-realtyna-wpl
Realtyna Organic IDX
11 known vulnerabilities on record. Add your version above to see which ones affect you.
Sep 17, 2026Realtyna Organic IDX plugin + WPL Real Estate: Does not sanitise and escape some of its parameters before reflecting them back in the pageCVE-2026-91014 · fixed in 5.4.2 · reported by WPScanHigh 7.1
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into following a crafted link (reflected XSS).
Aug 27, 2026Unauthenticated Cross Site Scripting (XSS) in Realtyna Organic IDX plugin <= 5.4.1 versions.CVE-2026-78261 · affects up to 5.4.1 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Realtyna Organic IDX plugin <= 5.4.1 versions.
Jul 31, 2026Realtyna Organic IDX: Arbitrary File UploadCVE-2026-16236 · affects up to 5.3.0 · reported by WordfenceHigh 8.8
The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 5.3.0. This is due to missing file extension and content validation in the saveLiveImages() function combined with an insufficient authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 31, 2026Realtyna Organic IDX plugin + WPL Real Estate: Arbitrary File UploadCVE-2026-14483 · affects up to 5.2.0 · reported by WordfenceCritical 9.8
The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via the upload function. This is due to missing file type validation in the upload function, combined with a publicly accessible I/O endpoint authenticated solely by static, plugin-seeded API credentials that are identical across all installations. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The WPL I/O service endpoint is registered on the public WordPress init hook with no WordPress capability check, and the required api_key and api_secret values are static defaults seeded by the plugin's own SQL migration files, meaning any unauthenticated attacker who knows these publicly documented defaults can reach and exploit the vulnerable upload path.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 27, 2026Realtyna Organic IDX plugin + WPL Real Estate: Does not validate the type of uploaded filesCVE-2026-13714 · fixed in 5.3.0 · reported by WPScanCritical 9.8
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all installations. This makes it possible for unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.
Jul 13, 2026Realtyna Organic IDX: Improper Control of Generation of Code ('Code Injection')CVE-2026-57811 · affects up to 5.2.0 · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows Remote Code Inclusion.This issue affects Realtyna Organic IDX plugin: from n/a through <= 5.2.0.
Jun 15, 2026Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions.CVE-2026-45439 · affects up to 5.1.0 · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions.
Aug 20, 2025Realtyna Organic IDX: Cross-Site Request Forgery (CSRF)CVE-2025-54052 · affects up to 5.0.0 · reported by PatchstackHigh 7.5
Cross-Site Request Forgery (CSRF) vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows PHP Local File Inclusion.This issue affects Realtyna Organic IDX plugin: from n/a through <= 5.0.0.
Jul 12, 2024Realtyna Organic IDX: Unrestricted Upload of File with Dangerous TypeCVE-2024-38736 · affects up to 4.14.13 · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Realtyna Realtyna Organic IDX plugin allows Code Injection.This issue affects Realtyna Organic IDX plugin: from n/a through 4.14.13.
May 3, 2024Realtyna Organic IDX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33924 · affects up to 4.14.4 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Realtyna Realtyna Organic IDX plugin allows Reflected XSS.This issue affects Realtyna Organic IDX plugin: from n/a through 4.14.4.
Apr 15, 2024Realtyna Organic IDX: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-32128 · affects up to 4.14.4 · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Realtyna Realtyna Organic IDX plugin.This issue affects Realtyna Organic IDX plugin: from n/a through 4.14.4.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.