Advisories · Technology

Estatik Real Estate Plugin.

Every CVE that names Estatik Real Estate Plugin among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-76790 CVE record

CVSS 7.1 High

Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter
- Estatik Real Estate Plugin
- Cross-site scripting (XSS)
Not analysed yet 19 Sept 2026
CVE-2026-18044 CVE record

CVSS 3.7 Low

Estatik Real Estate Plugin < 4.3.4 - Unauthenticated Arbitrary-Recipient Mail Relay via Signed-Value Mismatch
- Estatik Real Estate Plugin
- CWE-345
Not analysed yet 12 Aug 2026
CVE-2026-16262 CVE record

CVSS 7.5 High

Estatik < 4.3.3 - Login CSRF
- Estatik Real Estate Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 7 Aug 2026
CVE-2026-14547 CVE record

CVSS 5.3 Medium

Estatik Real Estate Plugin < 4.3.3 - Unauthenticated Arbitrary-Recipient Mail Relay via Request Form
- Estatik Real Estate Plugin
- Authentication bypass
Not analysed yet 6 Aug 2026
CVE-2023-6050 CVE record

CVSS 6.1 Medium

Estatik Real Estate Plugin < 4.1.1 - Reflected XSS
- Estatik Real Estate Plugin
Not analysed yet 15 Jan 2024
CVE-2023-6048 CVE record

CVSS 6.5 Medium

Estatik Real Estate Plugin < 4.1.1 - Subscriber+ Arbitrary Option Update
- Estatik Real Estate Plugin
Not analysed yet 15 Jan 2024
CVE-2023-6049 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Estatik Real Estate Plugin < 4.1.1 - Unauthenticated PHP Object Injection
- Estatik Real Estate Plugin
Not analysed yet 15 Jan 2024