Veille CVE
Recherche « Estatik »
7 CVE
-
CVE-2026-96350 9.8 Critique
Estatik
Subscriber Privilege Escalation in Estatik <= 4.3.5 versions.
-
CVE-2026-96345 7.6 Élevée
Estatik
Administrator SQL Injection in Estatik <= 4.3.5 versions.
-
CVE-2026-76790 7.1 Élevée
Unknown Estatik Real Estate Plugin
The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting.
-
CVE-2026-81775 7.1 Élevée
Estatik
Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions.
-
CVE-2026-18044 3.7 Faible
Unknown Estatik Real Estate Plugin
The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on sites where the form is configured to route to a custom address.
-
CVE-2026-16262 7.5 Élevée
Unknown Estatik Real Estate Plugin
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account (login CSRF), so that the victim's subsequent activity is stored under and readable by the attacker.
-
CVE-2026-14547 5.3 Moyenne
Unknown Estatik Real Estate Plugin
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To, effectively using the site as a mail relay for spam or phishing.