The Realtyna Organic IDX plugin versions up to 4.14.4 contain a reflected Cross-site Scripting (CWE-79) vulnerability due to improper input neutralization during web page generation. This allows attackers to inject malicious scripts that execute within the victim's browser session, potentially leading to information disclosure, session hijacking, or other impacts affecting confidentiality, integrity, and availability. The vulnerability is remotely exploitable without privileges and requires user interaction. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). No official fix or patch has been disclosed by the vendor at this time.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the affected web application, potentially resulting in partial loss of confidentiality, integrity, and availability of the affected system or user data. The reflected XSS nature means an attacker must convince a user to interact with a crafted link or input. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing web application firewall (WAF) rules to detect and block reflected XSS attempts and avoid clicking on suspicious links related to the affected plugin. Monitor vendor channels for updates and apply patches promptly once available.