Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-21
Estatik Real Estate Plugin - Security Vulnerability (CVE-2026-76790)
The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting.
PLUGIN
Estatik Real Estate Plugin
CVE-2026-76790
Risk Score
Threat Entry
Updated 2026-08-26
Estatik Real Estate Plugin - Improper Input Validation (CVE-2026-18044)
The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on sites where the form is configured to route to a custom address.
PLUGIN
Estatik Real Estate Plugin
CVE-2026-18044
Risk Score
Threat Entry
Updated 2026-08-26
Estatik Real Estate Plugin - Cross-Site Request Forgery (CSRF) (CVE-2026-16262)
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account (login CSRF), so that the victim's subsequent activity is stored under and readable by the attacker.
PLUGIN
Estatik Real Estate Plugin
CVE-2026-16262
Risk Score
Threat Entry
Updated 2026-08-26
Estatik Real Estate Plugin - Security Vulnerability (CVE-2026-14547)
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To, effectively using the site as a mail relay for spam or phishing.
PLUGIN
Estatik Real Estate Plugin
CVE-2026-14547
Risk Score
Threat Entry
Updated 2026-06-17
Estatik Real Estate Plugin - PHP Object Injection (CVE-2023-6049)
The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget chain is present on the blog
PLUGIN
Estatik Real Estate Plugin
CVE-2023-6049
Risk Score
Threat Entry
Updated 2026-06-17
Estatik Real Estate Plugin - Security Vulnerability (CVE-2023-6048)
The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not prevent user with low privileges on the site, like subscribers, from setting any of the site's options to 1, which could be used to break sites and lead to DoS when certain options are reset
PLUGIN
Estatik Real Estate Plugin
CVE-2023-6048
Risk Score
Threat Entry
Updated 2026-06-17
Estatik Real Estate Plugin - Cross-Site Scripting (XSS) (CVE-2023-6050)
The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not sanitise and escape various parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Estatik Real Estate Plugin
CVE-2023-6050
Risk Score