Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?EstateEssential Real EstateRealtyna Organic IDXReal Estate ManagerReal Estate 7Estatik Real EstateSimplyRETS Real Estate IDXReal Estate Manager Pro
Plugin · estatik
Estatik Real Estate
14 known vulnerabilities on record. Add your version above to see which ones affect you.
Sep 30, 2026Subscriber Privilege Escalation in Estatik <= 4.3.5 versions.CVE-2026-96350 · affects up to 4.3.5 · reported by PatchstackCritical 9.8
Subscriber Privilege Escalation in Estatik <= 4.3.5 versions.
Sep 30, 2026Administrator SQL Injection in Estatik <= 4.3.5 versions.CVE-2026-96345 · affects up to 4.3.5 · reported by PatchstackHigh 7.6
Administrator SQL Injection in Estatik <= 4.3.5 versions.
Sep 19, 2026Estatik Real Estate: Does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX responseCVE-2026-76790 · fixed in 4.3.5 · reported by WPScanHigh 7.1
The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting.
Sep 2, 2026Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions.CVE-2026-81775 · affects up to 4.3.4 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions.
Aug 12, 2026Estatik Real Estate: Does not validate the same recipient list that it later uses to address the message sent by its property request formCVE-2026-18044 · fixed in 4.3.4 · reported by WPScanLow 3.7
The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on sites where the form is configured to route to a custom address.
Aug 7, 2026Estatik Real Estate: Does not bind its OAuth social login flow to the initiating user sessionCVE-2026-16262 · fixed in 4.3.3 · reported by WPScanHigh 7.5
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account (login CSRF), so that the victim's subsequent activity is stored under and readable by the attacker.
Aug 6, 2026Estatik Real Estate: Does not properly enforce its anti-spam check or restrict the recipient routing of its property request formCVE-2026-14547 · fixed in 4.3.3 · reported by WPScanMedium 5.3
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To, effectively using the site as a mail relay for spam or phishing.
Oct 26, 2025Estatik: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62963 · affects up to 4.3.1 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatik Estatik estatik allows DOM-Based XSS.This issue affects Estatik: from n/a through <= 4.3.1.
Feb 25, 2025Estatik: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-26905 · affects up to 4.3.0 · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estatik Estatik estatik allows PHP Local File Inclusion.This issue affects Estatik: from n/a through <= 4.3.0.
Jan 15, 2024Estatik Real Estate: Does not sanitise and escape various parameters and generated URLs before outputting them back in attributesCVE-2023-6050 · fixed in 4.1.1 · reported by WPScanMedium 6.1
The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not sanitise and escape various parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Jan 15, 2024Estatik Real Estate: Unserializes user input via some of its cookiesCVE-2023-6049 · fixed in 4.1.1 · reported by WPScanCritical 9.8
The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget chain is present on the blog
Jan 15, 2024Estatik Real Estate: Does not prevent user with low privileges on the siteCVE-2023-6048 · fixed in 4.1.1 · reported by WPScanMedium 6.5
The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not prevent user with low privileges on the site, like subscribers, from setting any of the site's options to 1, which could be used to break sites and lead to DoS when certain options are reset
Sep 16, 2019The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload (exploitable with CSRF) via es_media_images[] to wp-admin/admin-ajax.php.CVE-2016-10959 · fixed in 2.3.1 · reported by MITREMedium 6.5
The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload (exploitable with CSRF) via es_media_images[] to wp-admin/admin-ajax.php.
Sep 16, 2019The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via es_media_images[] to wp-admin/admin-ajax.php.CVE-2016-10958 · fixed in 2.3.0 · reported by MITREHigh 7.5
The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via es_media_images[] to wp-admin/admin-ajax.php.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.