Estatik
Monthly
Unauthenticated cross-site scripting in the Estatik real estate WordPress plugin affects all versions up to and including 4.3.4, allowing remote unauthenticated attackers to inject arbitrary JavaScript into pages viewed by other users. The CVSS scope-change flag (S:C) indicates the injected script can affect browser sessions beyond the vulnerable component itself - typically enabling session hijacking, credential theft, or unauthorized actions performed on behalf of logged-in administrators. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Unauthenticated cross-site scripting in the Estatik real estate WordPress plugin affects all versions up to and including 4.3.4, allowing remote unauthenticated attackers to inject arbitrary JavaScript into pages viewed by other users. The CVSS scope-change flag (S:C) indicates the injected script can affect browser sessions beyond the vulnerable component itself - typically enabling session hijacking, credential theft, or unauthorized actions performed on behalf of logged-in administrators. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.