CVE-2026-76790

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting...

EUVD-2026-83501

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting...

CVE-2026-76790 Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting...

CVE-2026-76790: Improper Neutralization of Input During Web Page Generation

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting...

PT-2026-95754

Name of the Vulnerable Software and Affected Versions Estatik Real Estate Plugin WordPress plugin versions prior to 4.3.5 Description Reflected Cross-Site Scripting occurs because the plugin fails to sanitize and escape several values decoded from a request parameter before reflecting them in an...

EUVD-2026-57177

The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on...

CVE-2026-18044: Insufficient Verification of Data Authenticity

The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on...

PT-2026-68871

Name of the Vulnerable Software and Affected Versions Estatik Real Estate Plugin WordPress plugin versions prior to 4.3.3 Description The plugin fails to bind its OAuth social login flow to the initiating user session. This allows an unauthenticated attacker to perform a login CSRF Cross-Site...

CVE-2026-16262: Cross-Site Request Forgery (CSRF)

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account login CSRF, so that the victim's subsequent activity is stored under and...

CVE-2026-14547: Improper Authentication

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To, effectively...

PT-2026-68394

Name of the Vulnerable Software and Affected Versions Estatik Real Estate Plugin versions prior to 4.3.3 Description This issue occurs because the property request form does not properly enforce anti-spam checks or restrict recipient routing. This allows unauthenticated users to send emails to...

EUVD-2023-58306

Malicious code in bioql PyPI...

EUVD-2023-58307

Malicious code in bioql PyPI...

EUVD-2023-58305

Malicious code in bioql PyPI...

CVE-2023-6048

The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not prevent user with low privileges on the site, like subscribers, from setting any of the site's options to 1, which could be used to break sites and lead to DoS when certain options are reset...

CVE-2023-6049

The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget chain is present on the blog...

CVE-2023-6049

The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget chain is present on the blog...

Design/Logic Flaw

The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget chain is present on the blog...

Cross site scripting

The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not sanitise and escape various parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-6050 Estatik Real Estate Plugin < 4.1.1 - Reflected XSS

The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not sanitise and escape various parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...