CVE-2023-6141

The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Stored XSS attacks...

CVE-2023-6139

The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Denial of Service attacks...

CVE-2023-6139

The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Denial of Service attacks...

Remote code execution

The Essential Real Estate WordPress plugin before 4.4.0 does not prevent users with limited privileges on the site, like subscribers, from momentarily uploading malicious PHP files disguised as ZIP archives, which may lead to remote code execution...

CVE-2023-6140 Essential Real Estate < 4.4 - Subscriber+ Arbitrary File Upload

The Essential Real Estate WordPress plugin before 4.4.0 does not prevent users with limited privileges on the site, like subscribers, from momentarily uploading malicious PHP files disguised as ZIP archives, which may lead to remote code execution...

CVE-2023-6140

The CVE affects the Essential Real Estate WordPress plugin for versions prior to 4.4.0. The vulnerability allows users with limited privileges (e.g., subscribers) to upload malicious PHP files disguised as ZIP archives, potentially leading to remote code execution. Red Hat/NVD entries and third-p...

CVE-2023-6141 Essential Real Estate < 4.4.0 - Subscriber+ Stored XSS

The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Stored XSS attacks...

CVE-2023-6141 Essential Real Estate < 4.4.0 - Subscriber+ Stored XSS

The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Stored XSS attacks...

CVE-2023-6141

The Essential Real Estate WordPress plugin prior to version 4.4.0 is vulnerable due to missing capability checks on AJAX actions, enabling a subscriber-level attacker to perform Stored XSS. Root cause: improper authorization in AJAX handlers. Impact: stored XSS possible with a subscriber account;...

CVE-2023-6139

CVE-2023-6139 affects the Essential Real Estate WordPress plugin prior to version 4.4.0. The issue is missing capability checks on AJAX actions, enabling a subscriber to trigger Denial of Service. The CVSS v3.1 base score is 6.5 (MEDIUM). Remediation: update to 4.4.0 or newer; a temporary mitigat...

CVE-2023-6139 Essential Real Estate < 4.4.0 - Subscriber+ Denial of Service via Arbitrary Option Update

The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Denial of Service attacks...

WordPress Plugin Essential Real Estate Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers running PHP and MySQL.WordPress plugin i...

WordPress Plugin Essential Real Estate Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability in WordPress Plugi...

WordPress Plugin Essential Real Estate Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers running PHP and MySQL.WordPress plugin i...

PT-2024-14888 · WordPress · Essential Real Estate

Name of the Vulnerable Software and Affected Versions: The Essential Real Estate WordPress plugin versions prior to 4.4.0 Description: The issue arises from the plugin not applying proper capability checks on its AJAX actions. This allows attackers with a subscriber account to conduct Stored XSS...

PT-2024-14886 · WordPress · Essential Real Estate

Name of the Vulnerable Software and Affected Versions: The Essential Real Estate WordPress plugin versions prior to 4.4.0 Description: The issue arises from the plugin not applying proper capability checks on its AJAX actions. This allows attackers with a subscriber account to conduct Denial of...

CVE-2023-7044

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom ID in all versions up to, and including, 5.9.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2023-7044

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom ID in all versions up to, and including, 5.9.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2023-7044 Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom ID in all versions up to, and including, 5.9.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2023-7044

CVE-2023-7044 affects the WordPress plugin Essential Addons for Elementor (Best Elementor Templates, Widgets, Kits & WooCommerce Builders). It is a stored XSS via a custom ID in versions up to and including 5.9.2 caused by insufficient input sanitization and output escaping. Exploitation requires...