Estatik Real Estate Plugin
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:estatik_real_estate_plugin:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Estatik Real Estate Plugin (e6e9f461-513f-5dbd-a774-cd02f1d95222) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-18044 |
vulnerable | 2026-09-16 04:34:02.115203 |
Estatik Real Estate Plugin < 4.3.4 - Unauthenticated Arbitrary-Recipient Mail Relay via Signed-Value Mismatch
LOW (3.7)
The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on sites where the form is configured to route to a custom address.
Published: 2026-08-12T11:24:02.980Z
Updated: 2026-08-12T12:08:41.797Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-14547 |
vulnerable | 2026-09-16 04:33:11.515355 |
Estatik Real Estate Plugin < 4.3.3 - Unauthenticated Arbitrary-Recipient Mail Relay via Request Form
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To, effectively using the site as a mail relay for spam or phishing.
Published: 2026-08-06T06:00:09.356Z
Updated: 2026-08-06T14:11:59.520Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16262 |
vulnerable | 2026-09-16 04:32:56.337638 |
Estatik < 4.3.3 - Login CSRF
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account (login CSRF), so that the victim's subsequent activity is stored under and readable by the attacker.
Published: 2026-08-07T06:00:14.003Z
Updated: 2026-08-07T18:17:20.501Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-6050 |
vulnerable | 2026-06-08 06:19:45.463116 |
Estatik Real Estate Plugin < 4.1.1 - Reflected XSS
The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not sanitise and escape various parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Published: 2024-01-15T15:10:42.097Z
Updated: 2025-06-03T14:00:22.782Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-6049 |
vulnerable | 2026-06-08 06:19:45.462720 |
Estatik Real Estate Plugin < 4.1.1 - Unauthenticated PHP Object Injection
The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget chain is present on the blog
Published: 2024-01-15T15:10:39.151Z
Updated: 2025-06-03T14:00:44.618Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-6048 |
vulnerable | 2026-06-08 06:19:45.461145 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.