CVE-2026-76790

HighCVSS 7.1

Published: 19/09/2026(UTC)Updated: 21/09/2026(UTC)Translated: 19/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting.

Risk Assessment

An attacker can send a crafted link to a victim that executes malicious scripts in their browser, enabling session or data theft.

Recommendation

Update the plugin to version 4.3.5 or later. Educate users about the risks of clicking suspicious links.

Other vulnerabilities in Estatik Real Estate Plugin

CVE-2026-18044Low
The Estatik Real Estate Plugin for WordPress before version 4.3.4 does not validate the recipient list used for messages sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body, and Reply-To on sites where the form is configured to route to a custom address.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS