My IDX Home Search
My IDX Home Search has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2024; all 2 are fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10. 2024 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).
Every one of the 2 issues recorded for My IDX Home Search has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. My IDX Home Search is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2024-12502My IDX Home Search <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

My IDX Home Search
Author
Home ASAP
Most real estate agents want one thing above all from their website: new leads they can turn into home sales. MyIDX Home Search uses the power of the MLS to attract potential home buyers. From there, MyIDX Home Search captures their contact information, and automatically sends the info about that lead to the agent. Flexible Display Options MyIDX Home Search gives you the option to embed just an MLS search form or a full landing page into your design. Plus, you can choose whether to open search results in a modal window on the same page or in a new tab. Outstanding MLS Coverage We cover over 200 MLSs across the United States. That’s over 98% of active listings in the U.S. You can learn more about which MLS’s are covered by visiting https://about.homeasap.com/wordpress/idx-mls-check. Search Features Users Demand MyIDX Home Search by Home ASAP was built with the end user in mind. Home buyers can easily toggle between map and grid views to find new home in a way that makes sense to them. Plus, each listing includes a high-res photo gallery, neighborhood info, and more. Easy Facebook Integration As the leading IDX search provider for Facebook, we make it easy to leverage social media. Simply connect to a Facebook page, and we’ll automatically add up 4 posts per month promoting the agent’s home search. Plus, potential buyers can sign in and save searches using their Facebook credentials to make you get accurate contact info. Automatic Drip E-mail Campaigns MyIDX Home Search also comes with powerful tools that help agents market themselves to homebuyers with minimal effort. Built-in features such as automatic listing update e-mail campaigns based on searches let agents market to homebuyers even after they leave the site. Even better, all of this powerful marketing comes at a fraction of the cost of other IDX search plugins. Built-In Lead Capture Of course, most agents want one thing from a website, and that’s leads. That is why we include built-in lead capture forms that allow visitors to easily connect to new buyers. See It In Action Want to see what MyIDX can do? Visit our demo page Having trouble? Visit our troubleshooting guide at helpcenter.homeasap.com/idx-home-search-wordpress-help/. External services This plugin relies on the HomeASAP service to provide MLS/IDX listing data. It is the entire purpose of the plugin: without a HomeASAP subscription there is nothing for it to display. Agent lookup (admin only). When you type a name or e-mail into the agent search box on the plugin’s settings page, that search term is sent to https://api.homeasap.com so we can return matching Real Estate Agent Directory profiles. Nothing is sent until you type in that box. Listing display (front end). The shortcode embeds an iframe served from https://homeasap.com. As with any embedded frame, the visitor’s browser connects to homeasap.com directly, which receives the visitor’s IP address, user agent and the referring page. HomeASAP terms of use: https://dashboard.homeasap.com/Directory/TermsOfUse HomeASAP privacy policy: https://about.homeasap.com/home-asap-privacy-policy/
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C