CVE-2023-6048 Estatik Real Estate Plugin < 4.1.1 - Subscriber+ Arbitrary Option Update

The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not prevent user with low privileges on the site, like subscribers, from setting any of the site's options to 1, which could be used to break sites and lead to DoS when certain options are reset...

CVE-2023-6048

CVE-2023-6048 affects the Estatik Real Estate Plugin for WordPress (before 4.1.1). The issue allows a low-privilege user (e.g., Subscriber) to update arbitrary site options to 1, potentially breaking the site and causing denial of service when options are reset. The root cause is insufficient acc...

CVE-2023-6049 Estatik Real Estate Plugin < 4.1.1 - Unauthenticated PHP Object Injection

The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget chain is present on the blog...

CVE-2023-6049

The CVE-2023-6049 entry concerns the Estatik Real Estate Plugin for WordPress (versions prior to 4.1.1). The issue is triggered by unserializing user input via cookies, enabling unauthenticated PHP Object Injection when a suitable gadget chain exists on the blog. Affected component: the plugin’s ...

CVE-2023-6049 Estatik Real Estate Plugin < 4.1.1 - Unauthenticated PHP Object Injection

The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget chain is present on the blog...

WordPress Plugin Estatik Real Estate Plugin Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. The WordPress Plugin Estatik Real Estate...

WordPress Plugin Estatik Real Estate Plugin Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability in the WordPress...

PT-2024-14865 · WordPress · Estatik Real Estate Plugin

Name of the Vulnerable Software and Affected Versions: Estatik Real Estate Plugin WordPress plugin versions prior to 4.1.1 Description: The issue is related to Reflected Cross-Site Scripting, which occurs because the plugin does not properly sanitise and escape various parameters and generated UR...

PT-2024-14864 · WordPress · Estatik Real Estate Plugin

Name of the Vulnerable Software and Affected Versions: Estatik Real Estate Plugin WordPress plugin versions prior to 4.1.1 Description: The issue allows unauthenticated users to perform PHP Object Injection when a suitable gadget chain is present on the blog, due to the plugin unserializing user...

WordPress Plugin Estatik Real Estate Plugin Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability previously existed...

Estatik Real Estate Plugin < 4.1.1 - Unauthenticated PHP Object Injection

Description The plugin unserializes user input via some of its cookies, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget chain is present on the blog To simulate a gadget chain, put the following code in a plugin: class Evil public function wakeup :...

Estatik Real Estate Plugin < 4.1.1 - Reflected XSS

Description The plugin does not sanitise and escape various parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in admin open one of the URLs below some...

Estatik Real Estate Plugin < 4.1.1 - Reflected XSS

Description The plugin does not sanitise and escape various parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open one of the URLs below some...

Estatik Real Estate Plugin < 4.1.1 - Subscriber+ Arbitrary Option Update

Description The plugin does not prevent user with low privileges on the site, like subscribers, from setting any of the site's options to 1, which could be used to break sites and lead to DoS when certain options are reset PoC Run the below command in the developer console of the web browser whil...

Estatik Real Estate Plugin < 4.1.1 - Unauthenticated PHP Object Injection

Description The plugin unserializes user input via some of its cookies, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget chain is present on the blog PoC To simulate a gadget chain, put the following code in a plugin: class Evil public function wakeup...

Estatik Real Estate Plugin < 4.1.1 - Subscriber+ Arbitrary Option Update

Description The plugin does not prevent user with low privileges on the site, like subscribers, from setting any of the site's options to 1, which could be used to break sites and lead to DoS when certain options are reset Run the below command in the developer console of the web browser while...

CVE-2023-28490

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Estatik Estatik Mortgage Calculator plugin = 2.0.7 versions...

CVE-2023-28490

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Estatik Estatik Mortgage Calculator plugin = 2.0.7 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Estatik Estatik Mortgage Calculator plugin = 2.0.7 versions...

CVE-2023-28490 WordPress Mortgage Calculator Estatik Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Estatik Estatik Mortgage Calculator plugin = 2.0.7 versions...