CVE-2024-10552 is a stored cross-site scripting vulnerability (CWE-79) in the Flexmls® IDX Plugin for WordPress. It arises from insufficient input sanitization and output escaping of the 'api_key' and 'api_secret' parameters. Authenticated attackers with Contributor-level privileges or above can inject arbitrary scripts that execute in the context of users viewing the injected pages. Although a partial patch was applied in version 3.14.25, the vulnerability persists in version 3.14.26 and earlier. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impacts on confidentiality and integrity with no availability impact.

Successful exploitation allows authenticated users with Contributor-level access or higher to inject and execute arbitrary web scripts in the context of other users accessing the affected pages. This can lead to unauthorized disclosure of information and modification of data within the affected WordPress site. There is no indication of availability impact or known exploits in the wild at this time.

No official patch or full fix is confirmed for versions up to 3.14.26. A partial fix was introduced in version 3.14.25, but the vulnerability remains in 3.14.26. Users should verify with the vendor for updated patches or advisories. Until a full fix is available, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to the plugin. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.