CVE-2026-76790: Estatik Real Estate Plugin XSS Vulnerability

CVE-2026-76790 Overview

CVE-2026-76790 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Estatik Real Estate Plugin for WordPress. The flaw affects all plugin versions before 4.3.5. The plugin fails to sanitize and escape several values decoded from a request parameter before reflecting them in an unauthenticated AJAX response. Attackers can inject arbitrary JavaScript that executes in the browser context of any victim who visits a crafted link. The vulnerability is classified under [CWE-79] and requires user interaction to trigger.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the victim's browser, enabling session theft, credential harvesting, and administrative account takeover through crafted links.

Affected Products

Estatik Real Estate Plugin for WordPress versions before 4.3.5
WordPress sites using vulnerable AJAX endpoints exposed by the plugin
Any site administrator or visitor session accessible from an affected WordPress instance

Discovery Timeline

2026-09-19 - CVE-2026-76790 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-76790

Vulnerability Analysis

The Estatik Real Estate Plugin exposes an unauthenticated AJAX endpoint that accepts a request parameter containing encoded values. The plugin decodes these values and includes them directly in the AJAX response body without applying sanitization or output escaping. An attacker who crafts a malicious link and convinces a user to click it can inject arbitrary HTML and JavaScript into the response context.

Because the endpoint requires no authentication, exploitation only depends on user interaction with a crafted URL. The Estimated Exploit Prediction (EPSS) telemetry indicates a probability of 0.251% for exploitation in the next 30 days.

Root Cause

The root cause is missing input sanitization and output escaping [CWE-79] in the plugin's AJAX handler. The handler decodes attacker-supplied data from a request parameter and reflects it into the HTTP response without invoking WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses(). This allows arbitrary HTML and script content to render in the browser.

Attack Vector

An attacker crafts a URL targeting the vulnerable AJAX endpoint on a site running Estatik Real Estate Plugin below 4.3.5. The URL includes an encoded payload in the affected parameter. When a victim clicks the link, the plugin decodes and reflects the payload into the response, executing the injected script in the victim's browser session. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-76790

Indicators of Compromise

HTTP requests to WordPress admin-ajax.php containing encoded HTML entities or <script> fragments in Estatik-related action parameters
Referrer logs showing external sites linking directly to plugin AJAX endpoints with unusual query strings
Unexpected outbound requests from browsers to attacker-controlled domains after visiting a WordPress site with the plugin installed

Detection Strategies

Inspect web server logs for requests to plugin AJAX actions with parameter values containing URL-encoded <, >, javascript:, or onerror= patterns
Deploy a Web Application Firewall (WAF) rule that flags reflected XSS payloads targeting WordPress AJAX endpoints
Correlate anomalous session activity for authenticated administrators immediately after visits to plugin URLs

Monitoring Recommendations

Enable verbose access logging on wp-admin/admin-ajax.php and retain logs for retrospective analysis
Monitor for new administrator accounts, plugin installations, or theme modifications following suspicious AJAX traffic
Alert on WordPress user session cookies being transmitted to non-origin domains

How to Mitigate CVE-2026-76790

Immediate Actions Required

Update the Estatik Real Estate Plugin to version 4.3.5 or later on all WordPress installations
Audit administrator accounts and active sessions for signs of unauthorized activity following the disclosure date
Notify site administrators to avoid clicking untrusted links referencing the affected WordPress site

Patch Information

The vendor addressed CVE-2026-76790 in Estatik Real Estate Plugin version 4.3.5. The fix introduces proper sanitization and escaping of decoded request parameter values before they are reflected in the AJAX response. Refer to the WPScan Vulnerability Report for advisory details and version metadata.

Workarounds

Deactivate the Estatik Real Estate Plugin until the update to 4.3.5 can be deployed
Configure a WAF rule to block requests to the vulnerable AJAX action containing HTML or script metacharacters in the affected parameter
Apply a Content Security Policy (CSP) restricting inline script execution and limiting script sources to trusted origins

bash

# Update Estatik Real Estate Plugin via WP-CLI
wp plugin update estatik --version=4.3.5

# Verify installed version
wp plugin get estatik --field=version

# Temporarily deactivate if patching is delayed
wp plugin deactivate estatik