Administrator account creation via stored JavaScript

Stored XSS in IMPress for IDX Broker before 2.6.2 allows remote authenticated users to run JavaScript in an administrator's browser. The idx_update_recaptcha_key AJAX handler passes the untrusted idx_recaptcha_site_key value directly to update_option without capability or nonce checks, and the settings panel later renders the saved value. Subscriber-level access is sufficient, but exploitation requires an administrator to visit the panel; the script runs in that administrator's session and can create an administrator account.