Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-06
Essential Real Estate - Security Vulnerability (CVE-2026-90967)
The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users' invoices, including the invoice owner's name, account email address and financial details.
PLUGIN
Essential Real Estate
CVE-2026-90967
Risk Score
Threat Entry
Updated 2026-11-06
Essential Real Estate - Security Vulnerability (CVE-2026-90966)
The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing package selected for free activation is genuinely free or that the requesting user is entitled to it, allowing a self-registered customer to activate a paid package without payment and cause the site to record a paid invoice at the package's full price.
PLUGIN
Essential Real Estate
CVE-2026-90966
Risk Score
Threat Entry
Updated 2026-11-06
Essential Real Estate - Security Vulnerability (CVE-2026-90965)
The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve the images attached to property listings that have not been published.
PLUGIN
Essential Real Estate
CVE-2026-90965
Risk Score
Threat Entry
Updated 2026-11-06
Essential Real Estate - Security Vulnerability (CVE-2026-90964)
The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site.
PLUGIN
Essential Real Estate
CVE-2026-90964
Risk Score
Threat Entry
Updated 2026-11-06
Essential Real Estate - Security Vulnerability (CVE-2026-90963)
The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one of its AJAX actions, allowing unauthenticated users to read the full contents of property listings that have not been published, together with the private name, email address, phone number and office address of the listing agent.
PLUGIN
Essential Real Estate
CVE-2026-90963
Risk Score
Threat Entry
Updated 2026-11-04
Essential Real Estate - Security Vulnerability (CVE-2026-110964)
The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those owned by administrators.
PLUGIN
Essential Real Estate
CVE-2026-110964
Risk Score
Threat Entry
Updated 2026-10-22
Essential Real Estate - PHP Object Injection (CVE-2026-32465)
Customer PHP Object Injection in Essential Real Estate
PLUGIN
Essential Real Estate
CVE-2026-32465
Risk Score
Threat Entry
Updated 2026-06-17
Essential Real Estate - Broken Access Control (CVE-2025-68071)
Authorization Bypass Through User-Controlled Key vulnerability in g5theme Essential Real Estate essential-real-estate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Real Estate: from n/a through
PLUGIN
Essential Real Estate
CVE-2025-68071
Risk Score
Threat Entry
Updated 2026-06-17
Essential Real Estate - Broken Access Control (CVE-2025-66127)
Missing Authorization vulnerability in g5theme Essential Real Estate essential-real-estate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Real Estate: from n/a through
PLUGIN
Essential Real Estate
CVE-2025-66127
Risk Score
Threat Entry
Updated 2026-06-17
Essential Real Estate - Path Traversal (CVE-2025-48126)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in g5theme Essential Real Estate essential-real-estate allows PHP Local File Inclusion.This issue affects Essential Real Estate: from n/a through
PLUGIN
Essential Real Estate
CVE-2025-48126
Risk Score
Threat Entry
Updated 2026-06-17
Essential Real Estate - Path Traversal (CVE-2025-30849)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in g5theme Essential Real Estate essential-real-estate allows PHP Local File Inclusion.This issue affects Essential Real Estate: from n/a through
PLUGIN
Essential Real Estate
CVE-2025-30849
Risk Score
Threat Entry
Updated 2026-06-17
Essential Real Estate - Cross-Site Request Forgery (CSRF) (CVE-2025-24698)
Cross-Site Request Forgery (CSRF) vulnerability in g5theme Essential Real Estate essential-real-estate allows Cross Site Request Forgery.This issue affects Essential Real Estate: from n/a through
PLUGIN
Essential Real Estate
CVE-2025-24698
Risk Score
Threat Entry
Updated 2026-06-17
Essential Real Estate - Broken Access Control (CVE-2024-12329)
The Essential Real Estate plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several pages/post types in all versions up to, and including, 5.1.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to access invoices and transaction logs
PLUGIN
Essential Real Estate
CVE-2024-12329
Risk Score
Threat Entry
Updated 2026-06-17
Essential Real Estate - Improper Input Validation (CVE-2024-4274)
The Essential Real Estate plugin for WordPress is vulnerable to unauthorized loss of data due to insufficient validation on the remove_property_attachment_ajax() function in all versions up to, and including, 4.4.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary attachments.
PLUGIN
Essential Real Estate
CVE-2024-4274
Risk Score
Threat Entry
Updated 2026-06-17
Essential Real Estate - Cross-Site Scripting (XSS) (CVE-2024-4273)
The Essential Real Estate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ere_property_map' shortcode in all versions up to, and including, 4.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Essential Real Estate
CVE-2024-4273
Risk Score
Threat Entry
Updated 2026-06-17
Essential Real Estate - Remote Code Execution (CVE-2023-6140)
The Essential Real Estate WordPress plugin before 4.4.0 does not prevent users with limited privileges on the site, like subscribers, from momentarily uploading malicious PHP files disguised as ZIP archives, which may lead to remote code execution.
PLUGIN
Essential Real Estate
CVE-2023-6140
Risk Score
Threat Entry
Updated 2026-06-17
Essential Real Estate - Cross-Site Scripting (XSS) (CVE-2023-6141)
The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Stored XSS attacks.
PLUGIN
Essential Real Estate
CVE-2023-6141
Risk Score
Threat Entry
Updated 2026-06-17
Essential Real Estate - Denial of Service (CVE-2023-6139)
The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Denial of Service attacks.
PLUGIN
Essential Real Estate
CVE-2023-6139
Risk Score
Threat Entry
Updated 2026-06-17
Essential Real Estate - Remote Code Execution (CVE-2023-6827)
The Essential Real Estate plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'ajaxUploadFonts' function in versions up to, and including, 4.3.5. This makes it possible for authenticated attackers with subscriber-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2023-6140 appears to be a duplicate of this issue.
PLUGIN
Essential Real Estate
CVE-2023-6827
Risk Score
Threat Entry
Updated 2026-06-17
Essential Real Estate - Cross-Site Scripting (XSS) (CVE-2022-3933)
The Essential Real Estate WordPress plugin before 3.9.6 does not sanitize and escapes some parameters, which could allow users with a role as low as Admin to perform Cross-Site Scripting attacks.
PLUGIN
Essential Real Estate
CVE-2022-3933
Risk Score