CVE-2026-76790

Name of the Vulnerable Software and Affected Versions Estatik Real Estate Plugin WordPress plugin versions prior to 4.3.5

Description Reflected Cross-Site Scripting occurs because the plugin fails to sanitize and escape several values decoded from a request parameter before reflecting them in an unauthenticated AJAX response. Cross-Site Scripting is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users.

Recommendations Update the plugin to version 4.3.5 or later.