Estatik
7 CVEs across 5 Estatik products. Browse Estatik vulnerabilities, severities, and proof-of-concept exploits.
Estatik products with known CVEs
Estatik CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2025-62963 | Medium | 6.5 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatik Estatik estatik allows DOM-Based XSS.This issue a… |
CVE-2025-48136 | High | 7.5 | 2025-05-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Estatik Mortgage Calculator Estatik es… |
CVE-2025-26907 | High | 7.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatik Mortgage Calculator Estatik estatik-mortgage-calc… |
CVE-2025-26905 | High | 7.5 | 2025-02-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estatik Estatik estatik allows PHP Local File Inclusion.This is… |
CVE-2024-9354 | Medium | 6.1 | 2025-01-07 | The Estatik Mortgage Calculator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'color' parameter in all versions up to, and inclu… |
CVE-2023-6050 | Medium | 6.1 | 2024-01-15 | The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not sanitise and escape various parameters and generated URLs before outputting them back in… |
CVE-2023-6049 | Critical | 9.8 | 2024-01-15 | The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which could allow unauthenticated users to perfor… |
CVE-2023-6048 | Medium | 6.5 | 2024-01-15 | The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not prevent user with low privileges on the site, like subscribers, from setting any of the s… |
CVE-2023-28490 | High | 7.1 | 2023-09-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Estatik Estatik Mortgage Calculator plugin <= 2.0.7 versions. |
CVE-2023-40601 | High | 7.1 | 2023-09-06 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Estatik Estatik Mortgage Calculator plugin <= 2.0.7 versions. |
CVE-2016-10959 | Medium | 6.5 | 2019-09-16 | The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload (exploitable with CSRF) via es_media_images[] to wp-admin/admin-ajax.php. |
CVE-2016-10958 | High | 7.5 | 2019-09-16 | The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via es_media_images[] to wp-admin/admin-ajax.php. |