Description

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-19T07:16:32.650Z",
  "pubdate": "2026-09-19T07:16:32.650Z",
  "executiveSummary": "The Estatik Real Estate Plugin for WordPress, in versions prior to 4.3.5, is susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability.\nThis flaw arises due to the inadequate sanitization and output escaping of user-supplied data transmitted via AJAX request parameters.\nAn unauthenticated, remote attacker can exploit this vulnerability by crafting a malicious URL containing a JavaScript payload.\nWhen a victim visits this specially crafted URL, the malicious script executes within the context of the user's browser session.\nSuccessful exploitation allows an attacker to perform actions on behalf of the victim, potentially leading to unauthorized data access, session hijacking, or the defacement of the affected website.\nGiven that the vulnerability is exploitable without authentication, the risk level is high, necessitating immediate remediation via plugin updates.",
  "technicalDetails": "The vulnerability resides within the AJAX request handling logic of the Estatik Real Estate Plugin, specifically impacting versions prior to 4.3.5.\nThe root cause is the failure to implement appropriate input sanitization or output escaping mechanisms on specific parameters decoded from an incoming HTTP request before reflecting these values directly into the AJAX response.\nIn a typical Reflected XSS attack flow, the attacker identifies a public-facing endpoint that processes user input and reflects it back to the client.\nThe attacker crafts a malicious URI containing a payload (e.g., <script>alert(document.cookie)</script>) within the vulnerable parameter. This URI is then delivered to an authenticated or unauthenticated user via social engineering, phishing, or other distribution methods.\nWhen the victim's browser initiates a request to the vulnerable endpoint, the server processes the input and includes the unvalidated payload directly into the HTTP response body.\nBecause the server fails to escape the data, the victim's browser interprets the injected string as legitimate HTML or JavaScript code rather than plain text, causing the execution of the payload within the security context of the target domain.\nThis behavior allows the attacker to execute arbitrary scripts in the victim's browser, potentially facilitating the theft of session cookies, CSRF token interception, or the redirection of users to malicious third-party websites.\nThe flaw is particularly dangerous as it requires no prior authentication to the WordPress environment, significantly lowering the barrier to entry for potential adversaries.\nPost-exploitation impact ranges from temporary disruption of service to full account takeover, depending on the privileges of the compromised user and the specific environment configuration."
}