CVE-2026-76790: Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter

Q: Who can exploit this issue?

The vulnerable AJAX response is unauthenticated, so an attacker does not need a WordPress account to send a crafted request. Exploitation requires getting a victim to trigger that request and process the reflected script in their browser.

Q: Which installations are affected?

Estatik Real Estate Plugin versions before 4.3.5 are affected. The issue involves values decoded from the get_listings hash request parameter that are reflected without sanitization and escaping.

Published Sep 19, 2026

Updated

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting.

Affected Software

1 affected component

Estatik Estatik Real Estate Plugin (WordPress)<4.3.5

Event History

Sep 19, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

The vulnerable AJAX response is unauthenticated, so an attacker does not need a WordPress account to send a crafted request. Exploitation requires getting a victim to trigger that request and process the reflected script in their browser.

Which installations are affected?

Estatik Real Estate Plugin versions before 4.3.5 are affected. The issue involves values decoded from the get_listings hash request parameter that are reflected without sanitization and escaping.