Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?EstateEssential Real EstateRealtyna Organic IDXReal Estate ManagerReal Estate 7Estatik Real EstateSimplyRETS Real Estate IDXReal Estate Manager Pro
Plugin · essential-real-estate
Essential Real Estate
14 known vulnerabilities on record. Add your version above to see which ones affect you.
Aug 18, 2026Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions.CVE-2026-32465 · affects up to 5.3.3 · reported by PatchstackHigh 8.8
Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions.
Dec 16, 2025Essential Real Estate: Authorization Bypass Through User-Controlled KeyCVE-2025-68071 · affects up to 5.3.2 · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in g5theme Essential Real Estate essential-real-estate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Real Estate: from n/a through <= 5.3.2.
Dec 16, 2025Essential Real Estate: Missing AuthorizationCVE-2025-66127 · affects up to 5.3.2 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in g5theme Essential Real Estate essential-real-estate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Real Estate: from n/a through <= 5.3.2.
Jun 9, 2025Essential Real Estate: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-48126 · affects up to 5.2.9 · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in g5theme Essential Real Estate essential-real-estate allows PHP Local File Inclusion.This issue affects Essential Real Estate: from n/a through <= 5.2.9.
Apr 1, 2025Essential Real Estate: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30849 · affects up to 5.2.0 · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in g5theme Essential Real Estate essential-real-estate allows PHP Local File Inclusion.This issue affects Essential Real Estate: from n/a through <= 5.2.0.
Jan 24, 2025Essential Real Estate: Cross-Site Request Forgery (CSRF)CVE-2025-24698 · affects up to 5.1.8 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in g5theme Essential Real Estate essential-real-estate allows Cross Site Request Forgery.This issue affects Essential Real Estate: from n/a through <= 5.1.8.
Dec 12, 2024Essential Real Estate: Unauthorized access of dataCVE-2024-12329 · affects up to 5.1.6 · reported by WordfenceMedium 4.3
The Essential Real Estate plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several pages/post types in all versions up to, and including, 5.1.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to access invoices and transaction logs
Jun 4, 2024Essential Real Estate: Unauthorized loss of dataCVE-2024-4274 · affects up to 4.4.2 · reported by WordfenceMedium 4.3
The Essential Real Estate plugin for WordPress is vulnerable to unauthorized loss of data due to insufficient validation on the remove_property_attachment_ajax() function in all versions up to, and including, 4.4.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary attachments.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 4, 2024Essential Real Estate: Stored Cross-Site ScriptingCVE-2024-4273 · affects up to 4.4.2 · reported by WordfenceMedium 6.4
The Essential Real Estate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ere_property_map' shortcode in all versions up to, and including, 4.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Jan 8, 2024Essential Real Estate: Does not apply proper capability checks on its AJAX actionsCVE-2023-6141 · fixed in 4.4.0 · reported by WPScanMedium 5.4
The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Stored XSS attacks.
Jan 8, 2024Essential Real Estate: Does not prevent users with limited privileges on the siteCVE-2023-6140 · fixed in 4.4.0 · reported by WPScanHigh 8.8
The Essential Real Estate WordPress plugin before 4.4.0 does not prevent users with limited privileges on the site, like subscribers, from momentarily uploading malicious PHP files disguised as ZIP archives, which may lead to remote code execution.
Jan 8, 2024Essential Real Estate: Does not apply proper capability checks on its AJAX actionsCVE-2023-6139 · fixed in 4.4.0 · reported by WPScanMedium 6.5
The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Denial of Service attacks.
Dec 15, 2023Essential Real Estate: Arbitrary file uploadsCVE-2023-6827 · affects up to 4.3.5 · reported by WordfenceHigh 7.5
The Essential Real Estate plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'ajaxUploadFonts' function in versions up to, and including, 4.3.5. This makes it possible for authenticated attackers with subscriber-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2023-6140 appears to be a duplicate of this issue.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 12, 2022Essential Real Estate: Does not sanitize and escapes some parametersCVE-2022-3933 · fixed in 3.9.6 · reported by WPScanMedium 5.4
The Essential Real Estate WordPress plugin before 3.9.6 does not sanitize and escapes some parameters, which could allow users with a role as low as Admin to perform Cross-Site Scripting attacks.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.