Estatik Real Estate Plugin vulnerabilities
We track 3 vulnerabilities in Estatik Real Estate Plugin products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 19, 2026.
Latest Estatik Real Estate Plugin vulnerabilities
- 7.1 High severity
Estatik Real Estate Plugin: Improper Neutralization of Input During Web Page Generation
The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting.
- 7.5 High severity
Estatik Real Estate Plugin: Cross-Site Request Forgery
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account (login CSRF), so that the victim's s
- 9.8 Critical severity
Estatik Real Estate Plugin: Deserialization of Untrusted Data
The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget chain is present on the blog