From b09494310d14a81f935f172f55d3076cc3a91655 Mon Sep 17 00:00:00 2001
From: Cody Reichert <cody@reichertbrothers.com>
Date: Fri, 2 Oct 2026 21:55:56 -0500
Subject: [PATCH 1/2] Fix text sanitization in single listing error response

---
 src/simply-rets-utils.php             |  2 +-
 src/tests/test-api-error-messages.php | 80 +++++++++++++++++++++++++++
 2 files changed, 81 insertions(+), 1 deletion(-)
 create mode 100644 src/tests/test-api-error-messages.php

diff --git a/src/simply-rets-utils.php b/src/simply-rets-utils.php
index 50380a8..749ec9b 100644
--- a/src/simply-rets-utils.php
+++ b/src/simply-rets-utils.php
@@ -603,7 +603,7 @@ public static function noResultsMsg($response) {
         if (array_key_exists("message", $response)) {
             return (
                 '<br><p><strong>'
-                . $response['message']
+                . esc_html($response['message'])
                 . '</br></p></strong>'
             );
         }
diff --git a/src/tests/test-api-error-messages.php b/src/tests/test-api-error-messages.php
new file mode 100644
index 0000000..76c5b18
--- /dev/null
+++ b/src/tests/test-api-error-messages.php
@@ -0,0 +1,80 @@
+<?php
+if (! defined('ABSPATH')) {
+    exit;
+}
+
+class ApiErrorMessagesTest extends WP_UnitTestCase {
+
+    /**
+     * @dataProvider apiMessageProvider
+     */
+    public function testApiMessagesAreEscaped($message, $escaped_message) {
+        $expected = '<br><p><strong>' . $escaped_message . '</br></p></strong>';
+
+        $this->assertSame($expected, SrMessages::noResultsMsg(array('message' => $message)));
+
+        // Exercise the single-listing error path used by the reported exploit.
+        $response = array(
+            'lastUpdate' => null,
+            'response' => (object)array('message' => $message)
+        );
+        $this->assertSame($expected, SimplyRetsRenderer::srResidentialDetailsGenerator($response));
+    }
+
+    public static function apiMessageProvider() {
+        return array(
+            'reported SVG payload' => array(
+                'No property found wih MLS ID "<svg onload=alert(document.domain)>"',
+                'No property found wih MLS ID &quot;&lt;svg onload=alert(document.domain)&gt;&quot;'
+            ),
+            'script element' => array(
+                '<script>alert(document.domain)</script>',
+                '&lt;script&gt;alert(document.domain)&lt;/script&gt;'
+            ),
+            'wrapper breakout' => array(
+                '</strong></p><img src=x onerror="alert(1)">',
+                '&lt;/strong&gt;&lt;/p&gt;&lt;img src=x onerror=&quot;alert(1)&quot;&gt;'
+            ),
+            'encoded HTML entities' => array(
+                '&lt;svg onload=alert(1)&gt;',
+                '&lt;svg onload=alert(1)&gt;'
+            ),
+            'ordinary numeric ID' => array(
+                'No property found wih MLS ID "99999999"',
+                'No property found wih MLS ID &quot;99999999&quot;'
+            ),
+            'text with ampersands and apostrophes' => array(
+                "Listing isn't available & cannot be displayed.",
+                'Listing isn&#039;t available &amp; cannot be displayed.'
+            )
+        );
+    }
+
+    public function testObjectApiResponseIsEscaped() {
+        $this->assertSame(
+            '<br><p><strong>&lt;svg onload=alert(1)&gt;</br></p></strong>',
+            SrMessages::noResultsMsg((object)array('message' => '<svg onload=alert(1)>'))
+        );
+    }
+
+    public function testDefaultNoResultsMessageIsPreserved() {
+        delete_option('sr_custom_no_results_message');
+
+        $this->assertSame(
+            '<p><strong>0 listings matched your search. '
+                . 'Please try to broaden your search criteria or try again later.</strong></p>',
+            SrMessages::noResultsMsg(array())
+        );
+    }
+
+    public function testCustomNoResultsMarkupIsPreserved() {
+        $custom_message = '<p>No listings. <a href="/contact/">Contact us</a>.</p>';
+        update_option('sr_custom_no_results_message', $custom_message);
+
+        $this->assertSame($custom_message, SrMessages::noResultsMsg(array()));
+        $this->assertSame(
+            '<br><p><strong>&lt;svg onload=alert(1)&gt;</br></p></strong>',
+            SrMessages::noResultsMsg(array('message' => '<svg onload=alert(1)>'))
+        );
+    }
+}

From e5deb21ee4808eb795ca06585e19f8a3ab3f9f97 Mon Sep 17 00:00:00 2001
From: Cody Reichert <codyreichert@gmail.com>
Date: Sat, 3 Oct 2026 15:22:43 -0500
Subject: [PATCH 2/2] Bump version to 3.3.0

---
 CHANGELOG           | 4 ++++
 src/readme.txt      | 6 +++++-
 src/simply-rets.php | 4 ++--
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 52b6c5d..9fefe94 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,5 +1,9 @@
 # Changelog
 
+## 3.3.0
+
+* FIX: Escape API error messages to prevent reflected cross-site scripting on listing pages
+
 ## 3.2.9
 
 * FIX: Improve santization of unescaped attributes
diff --git a/src/readme.txt b/src/readme.txt
index c106f79..1f70212 100644
--- a/src/readme.txt
+++ b/src/readme.txt
@@ -4,7 +4,7 @@ Contributors: SimplyRETS
 Tags: real estate, idx, mls, rets, reso web api
 Requires at least: 3.0.1
 Tested up to: 7.0
-Stable tag: 3.2.9
+Stable tag: 3.3.0
 License: GPLv3
 License URI: http://www.gnu.org/licenses/gpl-3.0.html
 
@@ -235,6 +235,10 @@ listing sidebar widget.
 
 == Changelog ==
 
+= 3.3.0 =
+
+* FIX: Escape API error messages to prevent reflected cross-site scripting on listing pages
+
 = 3.2.9 =
 
 * FIX: Improve santization of unescaped attributes
diff --git a/src/simply-rets.php b/src/simply-rets.php
index a5195b0..c4e7277 100644
--- a/src/simply-rets.php
+++ b/src/simply-rets.php
@@ -4,7 +4,7 @@
 Plugin URI: https://simplyrets.com/wordpress-idx-plugin
 Description: Show your Real Estate listings on your Wordpress site. SimplyRETS provides a very simple set up and full control over your listings.
 Author: SimplyRETS
-Version: 3.2.9
+Version: 3.3.0
 License: GNU General Public License v3 or later
 
 Copyright (c) SimplyRETS 2014 - 2026
@@ -15,7 +15,7 @@
 }
 
 /* Code starts here */
-const SIMPLYRETSWP_VERSION = "v3.2.9";
+const SIMPLYRETSWP_VERSION = "v3.3.0";
 
 $plugin = plugin_basename(__FILE__);
 $php_version = phpversion();