CVE-2026-96350

Subscriber Privilege Escalation in Estatik = 4.3.5 versions...

CVE-2026-96345

Administrator SQL Injection in Estatik = 4.3.5 versions...

CVE-2026-96350 WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Estatik = 4.3.5 versions...

EUVD-2026-89863

Subscriber Privilege Escalation in Estatik = 4.3.5 versions...

CVE-2026-96350

The WordPress Estatik plugin (versions

EUVD-2026-89858

Administrator SQL Injection in Estatik = 4.3.5 versions...

CVE-2026-96345 WordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerability

Administrator SQL Injection in Estatik = 4.3.5 versions...

CVE-2026-96345 WordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerability

Administrator SQL Injection in Estatik = 4.3.5 versions...

CVE-2026-96345

The Estatik plugin for WordPress, version 4.3.5 and below , is vulnerable to an Administrator SQL Injection vulnerability. This flaw allows an attacker with high privileges to execute unauthorized SQL commands, potentially impacting confidentiality and availability. No specific exploit links or r...

CVE-2026-96350: Incorrect Privilege Assignment

Subscriber Privilege Escalation in Estatik = 4.3.5 versions...

CVE-2026-96345: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in Estatik = 4.3.5 versions...

WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by daroo in WordPress Plugin Estatik versions = 4.3.5...

WordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Estatik versions = 4.3.5...

CVE-2026-76790

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting...

EUVD-2026-83501

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting...

CVE-2026-76790 Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting...

CVE-2026-76790 Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting...

CVE-2026-76790

The Estatik Real Estate Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in versions before 4.3.5 . The root cause is the failure to sanitise and escape several values decoded from a request parameter before they are reflected back in an unauthenticated AJAX response . S...

CVE-2026-76790: Improper Neutralization of Input During Web Page Generation

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting...

PT-2026-95754

Name of the Vulnerable Software and Affected Versions Estatik Real Estate Plugin WordPress plugin versions prior to 4.3.5 Description Reflected Cross-Site Scripting occurs because the plugin fails to sanitize and escape several values decoded from a request parameter before reflecting them in an...