Essential Real Estate Security Vulnerabilities and Issues — Essential Real Estate CVE List

Lucene search

G5themeEssential Real Estate

12 matches found

CVE•added 2022/12/12 6:15 p.m.•66 views

CVE-2022-3933

The Essential Real Estate WordPress plugin before 3.9.6 does not sanitize and escapes some parameters, which could allow users with a role as low as Admin to perform Cross-Site Scripting attacks.

5.4CVSS5.3AI score0.24785EPSS

CVE•added 2024/01/08 7:15 p.m.•50 views

CVE-2023-6141

The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Stored XSS attacks.

5.4CVSS5.1AI score0.00255EPSS

CVE•added 2024/12/12 7:15 a.m.•47 views

CVE-2024-12329

The Essential Real Estate plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several pages/post types in all versions up to, and including, 5.1.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to acce...

4.3CVSS4.3AI score0.00079EPSS

CVE•added 2024/02/12 8:15 a.m.•45 views

CVE-2024-24797

Deserialization of Untrusted Data vulnerability in G5Theme ERE Recently Viewed – Essential Real Estate Add-On.This issue affects ERE Recently Viewed – Essential Real Estate Add-On: from n/a through 1.3.

9.8CVSS9.4AI score0.00433EPSS

CVE•added 2025/01/24 6:15 p.m.•44 views

CVE-2025-24698

Cross-Site Request Forgery (CSRF) vulnerability in G5Theme Essential Real Estate allows Cross Site Request Forgery. This issue affects Essential Real Estate: from n/a through 5.1.8.

4.3CVSS4.7AI score0.00022EPSS

CVE•added 2025/04/01 6:15 a.m.•42 views

CVE-2025-30849

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in g5theme Essential Real Estate allows PHP Local File Inclusion. This issue affects Essential Real Estate: from n/a through 5.2.0.

9.8CVSS8.3AI score0.00172EPSS

CVE•added 2024/01/08 7:15 p.m.•41 views

CVE-2023-6139

6.5CVSS6.3AI score0.00298EPSS

CVE•added 2024/01/08 7:15 p.m.•39 views

CVE-2023-6140

The Essential Real Estate WordPress plugin before 4.4.0 does not prevent users with limited privileges on the site, like subscribers, from momentarily uploading malicious PHP files disguised as ZIP archives, which may lead to remote code execution.

8.8CVSS9AI score0.03888EPSS

CVE•added 2023/12/15 8:15 a.m.•39 views

CVE-2023-6827

The Essential Real Estate plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'ajaxUploadFonts' function in versions up to, and including, 4.3.5. This makes it possible for authenticated attackers with subscriber-level capabilities or above, ...

8.8CVSS9.1AI score0.09631EPSS

CVE•added 2025/06/09 4:15 p.m.•36 views

CVE-2025-48126

9.8CVSS7.2AI score0.00165EPSS

CVE•added 2024/06/04 6:15 a.m.•31 views

CVE-2024-4273

The Essential Real Estate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ere_property_map' shortcode in all versions up to, and including, 4.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for au...

6.4CVSS5.9AI score0.00225EPSS

CVE•added 2024/06/04 6:15 a.m.•26 views

CVE-2024-4274

The Essential Real Estate plugin for WordPress is vulnerable to unauthorized loss of data due to insufficient validation on the remove_property_attachment_ajax() function in all versions up to, and including, 4.4.2. This makes it possible for authenticated attackers, with subscriber-level access an...

4.3CVSS4.8AI score0.00253EPSS