Estatik Real Estate Plugin
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:estatik_real_estate_plugin:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Estatik Real Estate Plugin (e6e9f461-513f-5dbd-a774-cd02f1d95222) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-76790 |
vulnerable | 2026-10-13 12:28:36.386271 |
Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter
The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting.
Published: 2026-09-19T06:00:14.762Z
Updated: 2026-09-19T13:20:11.208Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-18044 |
vulnerable | 2026-09-16 04:34:02.115203 |
Estatik Real Estate Plugin < 4.3.4 - Unauthenticated Arbitrary-Recipient Mail Relay via Signed-Value Mismatch
LOW (3.7)
The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on sites where the form is configured to route to a custom address.
Published: 2026-08-12T11:24:02.980Z
Updated: 2026-08-12T12:08:41.797Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-14547 |
vulnerable | 2026-09-16 04:33:11.515355 |
Estatik Real Estate Plugin < 4.3.3 - Unauthenticated Arbitrary-Recipient Mail Relay via Request Form
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To, effectively using the site as a mail relay for spam or phishing.
Published: 2026-08-06T06:00:09.356Z
Updated: 2026-08-06T14:11:59.520Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16262 |
vulnerable | 2026-09-16 04:32:56.337638 |
Estatik < 4.3.3 - Login CSRF
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account (login CSRF), so that the victim's subsequent activity is stored under and readable by the attacker.
Published: 2026-08-07T06:00:14.003Z
Updated: 2026-08-07T18:17:20.501Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-6050 |
vulnerable | 2026-06-08 06:19:45.463116 |
Estatik Real Estate Plugin < 4.1.1 - Reflected XSS
The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not sanitise and escape various parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Published: 2024-01-15T15:10:42.097Z
Updated: 2025-06-03T14:00:22.782Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-6049 |
vulnerable | 2026-06-08 06:19:45.462720 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-6048 |
vulnerable | 2026-06-08 06:19:45.461145 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.