Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

15 records

Vendor: Estatik Clear all filters
TI-2025-39111 CVE-2025-62963 · GHSA-44r5-gm3r-62wj

WordPress Estatik plugin <= 4.3.1 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatik Estatik estatik allows DOM-Based XSS.This issue affects Estatik: from n/a through <= 4.3.1.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00204 Published 2025-10-27 No fix listed CWE-79
TI-2025-30506 CVE-2025-48136 · GHSA-vw88-v4w8-cwv4

WordPress Mortgage Calculator Estatik plugin <= 2.0.12 - Local File Inclusion Vulnerability

Priority MEDIUM 41

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Estatik Mortgage Calculator Estatik estatik-mortgage-calculator allows PHP Local File Inclusion.Thi…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00559 Published 2025-05-16 No fix listed CWE-98
TI-2025-19778 CVE-2025-26907 · GHSA-gx9r-c2xr-w9xw

WordPress Estatik Mortgage Calculator plugin <= 2.0.12 - Local File Inclusion vulnerability

Priority LOW 33

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatik Mortgage Calculator Estatik estatik-mortgage-calculator allows Stored XSS.This issue affects Mortgage Calculat…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00489 Published 2025-02-25 No fix listed CWE-79
TI-2025-19776 CVE-2025-26905 · GHSA-9rw5-3hr5-p73f

WordPress Estatik plugin <= 4.3.0 - Local File Inclusion vulnerability

Priority LOW 34

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estatik Estatik estatik allows PHP Local File Inclusion.This issue affects Estatik: from n/a through <= 4.3.0.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00606 Published 2025-02-25 No fix listed CWE-22
TI-2024-08678 CVE-2024-9354 · GHSA-45q3-39w4-hv49

Estatik Mortgage Calculator <= 2.0.11 - Reflected Cross-Site Scripting

Priority LOW 28

The Estatik Mortgage Calculator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'color' parameter in all versions up to, and including, 2.0.11 due to insufficient input sanitization and outpu…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00452 Published 2025-01-07 No fix listed CWE-79
TI-2023-05571 CVE-2023-6050 · GHSA-x2vc-c3wq-5j89

Estatik Real Estate Plugin < 4.1.1 - Reflected XSS

Priority MEDIUM 60

The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not sanitise and escape various parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which c…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0042 Published 2024-01-15 Fixed in 4.1.1 CWE-79
TI-2023-05569 CVE-2023-6048 · GHSA-g9mm-pm8r-4ggj

Estatik Real Estate Plugin < 4.1.1 - Subscriber+ Arbitrary Option Update

Priority MEDIUM 62

The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not prevent user with low privileges on the site, like subscribers, from setting any of the site's options to 1, which could be used to break sites and le…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0061 Published 2024-01-15 Fixed in 4.1.1 CWE-862
TI-2023-05570 CVE-2023-6049 · GHSA-5fvv-qqh5-frx3

Estatik Real Estate Plugin < 4.1.1 - Unauthenticated PHP Object Injection

Priority HIGH 82

The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget chain is presen…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00926 Published 2024-01-15 Fixed in 4.1.1 CWE-502