Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Estatik Real Estate Plugin 4.1.1 Clear all filters
TI-2023-05571 CVE-2023-6050 · GHSA-x2vc-c3wq-5j89

Estatik Real Estate Plugin < 4.1.1 - Reflected XSS

Priority MEDIUM 60

The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not sanitise and escape various parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which c…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0042 Published 2024-01-15 Fixed in 4.1.1 CWE-79
TI-2023-05569 CVE-2023-6048 · GHSA-g9mm-pm8r-4ggj

Estatik Real Estate Plugin < 4.1.1 - Subscriber+ Arbitrary Option Update

Priority MEDIUM 62

The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not prevent user with low privileges on the site, like subscribers, from setting any of the site's options to 1, which could be used to break sites and le…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0061 Published 2024-01-15 Fixed in 4.1.1 CWE-862
TI-2023-05570 CVE-2023-6049 · GHSA-5fvv-qqh5-frx3

Estatik Real Estate Plugin < 4.1.1 - Unauthenticated PHP Object Injection

Priority HIGH 82

The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget chain is presen…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00926 Published 2024-01-15 Fixed in 4.1.1 CWE-502