WordPress plugin
Essential Real Estate security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical2
- High2
- Medium17
- Low0
All Essential Real Estate vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.3 | 5.3.4 - Authenticated (Subscriber+) Insecure Direct Object Reference 4.4.3 – 5.3.4Update to 5.3.5 | CVE-2026-110964 | |
| Medium5.3 | Missing Authorization ≤5.3.4Update to 5.3.5 | CVE-2026-90964 | |
| Medium4.3 | Missing Authorization ≤5.3.4Update to 5.3.5 | CVE-2026-90966 | |
| Medium4.3 | Authenticated (Customer+) Insecure Direct Object Reference ≤5.3.4Update to 5.3.5 | CVE-2026-90967 | |
| Medium5.3 | Unauthenticated Information Exposure ≤5.3.4Update to 5.3.5 | CVE-2026-90963 | |
| Medium5.3 | Missing Authorization ≤5.3.4Update to 5.3.5 | CVE-2026-90965 | |
| High7.5 | Authenticated (Customer+) PHP Object Injection ≤5.3.3Update to 5.3.4 | CVE-2026-32465 | |
| Medium5.3 | Missing Authorization ≤5.3.4Update to 5.3.5 | CVE-2025-66127 | |
| Medium4.3 | Authenticated (ERE Customer+) Insecure Direct Object Reference ≤5.3.4Update to 5.3.5 | CVE-2025-68071 | |
| Critical9.8 | Unauthenticated Local File Inclusion ≤5.2.1No patch available | CVE-2025-48126 | |
| Critical9.8 | Unauthenticated Local File Inclusion ≤5.2.0Update to 5.2.1 | CVE-2025-30849 | |
| Medium4.3 | Cross-Site Request Forgery ≤5.1.8Update to 5.1.9 | CVE-2025-24698 | |
| Medium4.3 | Missing Authorization to Authenticated (Contributor+) Information Exposure ≤5.1.6Update to 5.1.7 | CVE-2024-12329 | |
| Medium4.3 | Insecure Direct Object Reference to Arbitrary Attachment Deletion ≤4.4.4Update to 4.4.5 | CVE-2024-4274 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤4.4.2Update to 4.4.3 | CVE-2024-4273 | |
| Medium5.4 | Missing Authorization to Denial of Service ≤4.3.5Update to 4.4.0 | CVE-2023-6139 | |
| Medium6.4 | Missing Authorization to Stored Cross-Site Scripting ≤4.3.5Update to 4.4.0 | CVE-2023-6141 | |
| High7.5 | Authenticated (Subscriber+) Arbitrary File Upload ≤4.3.5Update to 4.4.0 | CVE-2023-6827 | |
| Medium6.1 | Reflected Cross-Site-Scripting ≤3.9.6Update to 4.0.0 | — | |
| Medium6.1 | Reflected Cross-Site-Scripting ≤3.9.5Update to 3.9.6 | CVE-2022-3933 | |
| Medium6.1 | Reflected Cross-Site Scripting <1.7.2Update to 1.7.2 | — |
- Medium4.35.3.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.4.3 – 5.3.4Update to 5.3.5
- Medium5.3Missing Authorization
≤5.3.4Update to 5.3.5
- Medium4.3Missing Authorization
≤5.3.4Update to 5.3.5
- Medium4.3Authenticated (Customer+) Insecure Direct Object Reference
≤5.3.4Update to 5.3.5
- Medium5.3Unauthenticated Information Exposure
≤5.3.4Update to 5.3.5
- Medium5.3Missing Authorization
≤5.3.4Update to 5.3.5
- High7.5Authenticated (Customer+) PHP Object Injection
≤5.3.3Update to 5.3.4
- Medium5.3Missing Authorization
≤5.3.4Update to 5.3.5
- Medium4.3Authenticated (ERE Customer+) Insecure Direct Object Reference
≤5.3.4Update to 5.3.5
- Critical9.8Unauthenticated Local File Inclusion
≤5.2.1No patch available
- Critical9.8Unauthenticated Local File Inclusion
≤5.2.0Update to 5.2.1
- Medium4.3Cross-Site Request Forgery
≤5.1.8Update to 5.1.9
- Medium4.3Missing Authorization to Authenticated (Contributor+) Information Exposure
≤5.1.6Update to 5.1.7
- Medium4.3Insecure Direct Object Reference to Arbitrary Attachment Deletion
≤4.4.4Update to 4.4.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤4.4.2Update to 4.4.3
- Medium5.4Missing Authorization to Denial of Service
≤4.3.5Update to 4.4.0
- Medium6.4Missing Authorization to Stored Cross-Site Scripting
≤4.3.5Update to 4.4.0
- High7.5Authenticated (Subscriber+) Arbitrary File Upload
≤4.3.5Update to 4.4.0
- Medium6.1Reflected Cross-Site-Scripting
≤3.9.6Update to 4.0.0
- Medium6.1Reflected Cross-Site-Scripting
≤3.9.5Update to 3.9.6
- Medium6.1Reflected Cross-Site Scripting
<1.7.2Update to 1.7.2
Essential Real Estate: common questions
Does Essential Real Estate have known vulnerabilities?
Yes. VulnCrest Radar lists 21 known vulnerabilities in Essential Real Estate: 2 critical, 2 high, 17 medium. At least one is not fixed in the latest version.
How do I check which version of Essential Real Estate I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Essential Real Estate vulnerability?
CVE-2026-110964, published Nov 4, 2026: Essential Real Estate 4.4.3 - 5.3.4 - Authenticated (Subscriber+) Insecure Direct Object Reference. Severity: Medium (CVSS 4.3).
Is any Essential Real Estate vulnerability listed in CISA KEV?
No. None of the known Essential Real Estate vulnerabilities is currently listed in the CISA KEV catalog.