WpEstate vulnerabilities

🔔 Create alert RSS

Published CVEs affecting WpEstate products: 3 record(s), with severity, exploitation and fixes.

Wpresidence Core 1 WP Rentals 1 Wpresidence 1

Exploited only (KEV) →

CVE-2026-25463 Medium · 6.5 CWE-79 Feb 19, 2026

WordPress Wpresidence Core plugin <= 5.4.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpEstate Wpresidence Core wpresidence-core allows Stored XSS.This issue affects Wpresidence Core: from n/a through <= 5.4.0.

CVE-2025-64286 Medium · 4.3 CWE-352 Oct 29, 2025

WordPress WP Rentals theme <= 3.13.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in WpEstate WP Rentals wprentals allows Cross Site Request Forgery.This issue affects WP Rentals: from n/a through <= 3.13.1.

CVE-2025-64199 Medium · 5.3 CWE-862 Oct 29, 2025

WordPress wpresidence theme <= 5.3.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in WpEstate wpresidence wpresidence allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpresidence: from n/a through <= 5.3.2.