OCTOBER 10, 2026
Live Feed
Back to database
Case File

CVE-2026-76790

HIGH · CVSS 7.1 EPSS 0.25%

Source: NVD + CISA KEV + EPSS · Published 2026-09-19 · Last synced 2026-10-10

CyberRota Analysis

AI-Generated

The Estatik Real Estate Plugin for WordPress versions prior to 4.3.5 is vulnerable to reflected cross-site scripting (XSS) due to inadequate sanitization and escaping of request parameters in unauthenticated AJAX responses. This flaw could allow attackers to inject malicious scripts into web pages viewed by users, potentially compromising user data and site integrity. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate the risk of exploitation.

CVE
CVE-2026-76790
Severity
HIGH
CVSS
7.1
EPSS
0.25%
WordPress

Original NVD Description

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting.