CVE-2026-76790

Received Received - Intake

Reflected XSS in Estatik Real Estate Plugin for WordPress

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: WPScan

Description

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-76790

Affected Vendors & Products

Vendor	Product	Version / Range
estatik	real_estate_plugin	to 4.3.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Reflected Cross-Site Scripting (XSS) vulnerability in the Estatik Real Estate Plugin for WordPress. The plugin before version 4.3.5 fails to properly sanitize and escape certain values decoded from a request parameter. These unsanitized values are then reflected back in an unauthenticated AJAX response, allowing attackers to inject malicious scripts into web pages viewed by users.

Detection Guidance

This vulnerability can be detected by checking the version of the Estatik Real Estate Plugin. If the version is below 4.3.5, the system is vulnerable. No specific commands are provided in the context.

Impact Analysis

This vulnerability can allow attackers to execute arbitrary JavaScript code in the context of a victim's browser when they visit a page with the malicious payload. This could lead to theft of session cookies, account takeover, or redirection to phishing sites. Users of WordPress sites running vulnerable versions of the Estatik plugin are at risk.

Mitigation Strategies

Immediately update the Estatik Real Estate Plugin to version 4.3.5 or later. Ensure that all WordPress plugins are kept up to date to prevent similar vulnerabilities.

Hi! I’m here to help you understand CVE-2026-76790. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70