This vulnerability (CVE-2026-73354) is an unauthenticated cross-site scripting (XSS) flaw in SimplyRETS Real Estate IDX versions <= 3.2.8. It stems from improper neutralization of input during web page generation (CWE-79), allowing attackers to inject malicious scripts that execute in the context of the victim's browser. The CVSS 3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, and user interaction required. The impact includes partial confidentiality, integrity, and availability loss. No vendor advisory or patch is currently available, and no known exploits have been reported.

Successful exploitation can lead to execution of arbitrary scripts in the victim's browser, potentially resulting in partial loss of confidentiality, integrity, and availability of user data or sessions. The vulnerability requires no authentication but does require user interaction. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted input and consider implementing web application firewalls or input sanitization as temporary mitigations.