The Estatik Real Estate Plugin for WordPress accepts a get_listings parameter, decodes a hash value that is never sanitised or escaped, and then reflects it back in an unauthenticated AJAX response. This flaw permits an attacker to inject arbitrary HTML or JavaScript into the page that a victim’s browser will execute, leading to a classic reflected cross‑site scripting attack. The immediate consequence is that a user visiting a crafted URL could execute malicious scripts in the context of the site, potentially stealing cookies, hijacking sessions, defacing content, or redirecting users to phishing sites.

The vulnerability exists in the Estatik Real Estate Plugin for WordPress versions earlier than 4.3.5. The plugin is distributed under the Estatik brand and has been found in many WordPress installations. Only versions prior to 4.3.5 lack the proper sanitisation.

The flaw is exploitable without authentication and relies solely on a crafted request from an external user. Because the EPSS score is unavailable and the exploit is not currently listed in the CISA KEV catalogue, the exact probability of attack is uncertain. Nonetheless, reflected XSS is a well‑known attack vector, and the lack of input filtering suggests that the vulnerability could be leveraged readily for phishing or session compromise. Risk remains high for any site that still hosts a vulnerable Estatik plugin version, especially if visitors can load the affected AJAX endpoint.