Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Essential Real Estate 4.4.0 Clear all filters
TI-2023-05645 CVE-2023-6140 · GHSA-pmx3-5c86-vxfm

Essential Real Estate < 4.4 - Subscriber+ Arbitrary File Upload

Priority HIGH 73

The Essential Real Estate WordPress plugin before 4.4.0 does not prevent users with limited privileges on the site, like subscribers, from momentarily uploading malicious PHP files disguised as ZIP archives, which may le…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01095 Published 2024-01-08 Fixed in 4.4.0 CWE-434
TI-2023-05646 CVE-2023-6141 · GHSA-p288-w88f-r2qg

Essential Real Estate < 4.4.0 - Subscriber+ Stored XSS

Priority LOW 25

The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Stored XSS attacks.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00403 Published 2024-01-08 Fixed in 4.4.0 CWE-79
TI-2023-05644 CVE-2023-6139 · GHSA-gm6c-33w6-46gc

Essential Real Estate < 4.4.0 - Subscriber+ Denial of Service via Arbitrary Option Update

Priority MEDIUM 62

The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Denial of Service attack…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00609 Published 2024-01-08 Fixed in 4.4.0