Unescaped User Input Reflects in WordPress Real Estate Plugin

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-76790 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Estatik Real Estate Plugin for WordPress versions before 4.3.5. The plugin fails to sanitize and escape user-supplied data from request parameters before reflecting it back in unauthenticated AJAX responses. This allows attackers to inject malicious JavaScript code that executes in victims' browsers without requiring authentication. Real estate websites and their visitors are at risk, as attackers can craft malicious URLs to steal session tokens, harvest credentials, redirect users to phishing sites, or perform actions on behalf of authenticated administrators.

Casky's 323 mapped security skills leverage Claude AI with extended reasoning to detect this vulnerability by analyzing attack patterns across MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance). Practitioners using Casky would observe detection patterns for unsanitized AJAX endpoints, parameter reflection analysis, and script injection attempts. The platform would flag instances where user input flows directly into response output without validation, identify suspicious parameter encoding patterns typical of XSS payloads, and correlate with reconnaissance activities where attackers probe for vulnerable endpoints. Practitioners would see detailed findings showing the exact parameter chains vulnerable to injection and recommended remediation steps such as input validation, output encoding, and implementing Content Security Policy headers.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-76790.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-76790

Casky has 323 skills that investigate the attack patterns behind CVE-2026-76790. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn