WordPress Plugin Vulnerabilities

Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter

Description

The plugin does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting.

Proof of Concept

Affects Plugins

Plugin icon
estatik
Fixed in 4.3.5

References

CVE
CVE-2026-76790

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Morato Antoine
Submitter
Morato Antoine
Submitter website
https://www.linkedin.com/in/antoine-morato-9601a0247
Verified
Yes
WPVDB ID
b722c7e9-7c8b-4510-85af-075b1bba9d66

Timeline

Publicly Published
2026-09-17 (about 2 days ago)
Added
2026-09-17 (about 1 day ago)
Last Updated
2026-09-17 (about 1 day ago)

Other

Published
Title
Published
2026-03-23
Title
WP Review Slider < 14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Published
2026-06-15
Title
Booking Calendar Contact Form < 1.0.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Published
2025-01-16
Title
Custom Widget Creator <= 1.0.5 - Reflected Cross-Site Scripting
Published
2024-05-22
Title
ProfilePress < 4.15.9 - Contributor+ Stored XSS
Published
2024-06-03
Title
Visual Composer Website Builder < 45.9.0 - Authenticated (Editor+) Stored Cross-Site Scripting