CVE-2026-76790

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting...

EUVD-2026-83501

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting...

CVE-2026-76790 Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting...

CVE-2026-76790

CVE-2026-76790 affects the Estatik Real Estate Plugin for WordPress prior to version 4.3.5 . The plugin fails to sanitise and escape several values decoded from the get_listings hash parameter before reflecting them in an unauthenticated AJAX response , enabling a Reflected Cross-Site Scripting (...

CVE-2026-81775

Unauthenticated Cross Site Scripting XSS in Estatik = 4.3.4 versions...

EUVD-2026-69932

Unauthenticated Cross Site Scripting XSS in Estatik = 4.3.4 versions...

CVE-2026-81775 WordPress Estatik plugin <= 4.3.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Estatik = 4.3.4 versions...

CVE-2026-81775

CVE-2026-81775 affects the WordPress Estatik plugin, versions 4.3.4 and below . The vulnerability is an unauthenticated Cross-Site Scripting (XSS) flaw, meaning an attacker can inject malicious scripts without prior authentication. The CVSS 3.1 score is 7.1 (HIGH) with the vector AV:N/AC:L/PR:N/U...

WordPress Estatik plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Neelakandan A in WordPress Plugin Estatik versions = 4.3.5...

CVE-2026-18044

The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on...

EUVD-2026-57177

The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on...

CVE-2026-18044

The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on...

CVE-2026-18044 Estatik Real Estate Plugin < 4.3.4 - Unauthenticated Arbitrary-Recipient Mail Relay via Signed-Value Mismatch

The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on...

CVE-2026-18044

CVE-2026-18044 : The Estatik Real Estate Plugin for WordPress, prior to version 4.3.4, suffers from an unauthenticated arbitrary-recipient mail relay. The root cause is a mismatch between the recipient list validated by the plugin and the recipient list later used to address the message sent by t...

PT-2026-71056

The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on...

CVE-2026-16262

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account login CSRF, so that the victim's subsequent activity is stored under and...

CVE-2026-16262 Estatik < 4.3.3 - Login CSRF

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account login CSRF, so that the victim's subsequent activity is stored under and...

EUVD-2026-54390

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account login CSRF, so that the victim's subsequent activity is stored under and...

CVE-2026-16262

The CVE affects the Estatik Real Estate Plugin for WordPress (versions before 4.3.3). The vulnerability arises because the plugin does not bind the OAuth social login flow to the initiating user session, enabling an unauthenticated attacker to perform a login CSRF and have the victim’s subsequent...

CVE-2026-14547

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To, effectively...