Essential Real Estate vulnerabilities and CVEs

Known vulnerabilities affecting Essential Real Estate, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.

6 vulnerabilities tracked.

6.5 The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before… CVE-2026-110964 4 Nov 2026
— The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX… CVE-2026-90967 5 Nov 2026
— The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing package selected for… CVE-2026-90966 5 Nov 2026
— The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX… CVE-2026-90965 5 Nov 2026
— The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing… CVE-2026-90964 5 Nov 2026
— The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one of its AJAX… CVE-2026-90963 5 Nov 2026

What this covers

This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that Essential Real Estate is free of vulnerabilities.

Query this from an agent over MCP · Check a lockfile by version

Essential Real Estate vulnerabilities and CVEs

What this covers

Other products tracked here