CVE-2026-76790 PUBLISHED

Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter

Assigner: WPScan
Reserved: 19.08.2026 Published: 19.09.2026 Updated: 19.09.2026

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting.

Product Status

Vendor Unknown
Product Estatik Real Estate Plugin
Versions Default: unaffected
  • affected from 4.0.1 to 4.3.5 (excl.)

Credits

  • Morato Antoine finder
  • WPScan coordinator

References

Problem Types

  • CWE-79 Cross-Site Scripting (XSS) CWE