Estatik Real Estate Plugin CVE-2026-76790

Exploitation requires the target site to run Estatik Real Estate Plugin version 4.0.1 through 4.3.4 (fixed in 4.3.5). No authentication is needed (PR:N) and the vulnerable AJAX endpoint is reachable by unauthenticated visitors, but successful attack requires user interaction (UI:R): the victim must open an attacker-crafted URL whose request parameter is decoded and reflected unescaped. Impact is limited to script execution in the victim's browser context - highest value when a logged-in administrator is tricked into clicking. No special server-side configuration toggle is stated as required; the primary limiting factors are the click-through requirement and social-engineering delivery.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1 High) describes a network-reachable, low-complexity, unauthenticated reflected XSS that requires user interaction (UI:R) - the victim must be lured into loading a crafted link/request. All signals are self-consistent: unauthenticated (PR:N) and easy to trigger (AC:L), but gated by the need for a click, which caps real-world impact to session-context script execution rather than direct server compromise. This is a genuinely credible issue rather than a paper high-CVSS: a public exploit exists (WPScan) and a vendor patch is available. However, EPSS is not provided and the CVE is NOT in CISA KEV, so there is no evidence of active or automated mass exploitation - reflected XSS requires per-victim social engineering and cannot be worm-driven, keeping practical priority moderate. One metric to scrutinize: the vendor's A:L (availability) is generous for reflected XSS, which typically has no availability impact; C:L/I:L for script execution in the victim's browser context is reasonable. Net: real and patchable, but medium urgency - prioritize patching, but this is not a drop-everything emergency absent KEV/EPSS evidence of widespread exploitation.

An attacker crafts a malicious URL carrying a specially encoded request parameter that, when the victim clicks it, causes the plugin's unauthenticated AJAX endpoint to decode and reflect attacker-controlled values into the response without escaping, executing JavaScript in the victim's browser. Because a public proof-of-concept exists (WPScan), a working payload is readily available, and no authentication is needed - only that the victim (potentially a logged-in administrator) opens the link. The injected script can steal session cookies/nonces or perform actions in the victim's authenticated context.