Unknown Optima Express Idx vulnerabilities

2 CVEs affecting Unknown Optima Express Idx, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-96899, published 2026-09-27.

More from Unknown.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-96899, published 2026-09-27. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head…
• CVE-2026-96897, published 2026-09-27. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to…