The vulnerability identified as CVE-2024-53726 affects RealtyCandy IDX Broker Extended up to version 1.5.1. It is a Cross-Site Request Forgery (CSRF) issue that enables stored XSS attacks. An attacker can trick an authenticated user into submitting a forged request, which the application processes with the user's privileges, potentially injecting malicious scripts stored on the server. The CVSS 3.1 base score is 7.1, reflecting network exploitability, low complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability.

Successful exploitation could allow attackers to execute stored XSS attacks via CSRF, leading to partial compromise of user confidentiality, integrity, and availability within the affected application. This could result in unauthorized actions performed with the victim's privileges and persistent malicious script injection. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying anti-CSRF tokens and restricting user input to mitigate stored XSS risks. Monitor vendor channels for updates and apply patches promptly once released.