CVE-2026-81775
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Unauthenticated XSS vulnerability in Estatik versions up to 4.3.4. An attacker can inject a malicious script that executes in the victim's browser.
Risk Assessment
Risk of data theft, session hijacking, or malware distribution.
Recommendation
Update the plugin to the latest version with the fix.
Other vulnerabilities in Estatik
See all- CVE-2026-96345High
Administrator SQL Injection vulnerability in Estatik up to version 4.3.5.
- CVE-2026-96350Critical
The Estatik plugin in versions up to and including 4.3.5 allows a subscriber to escalate privileges. A low-privileged user can gain higher privileges.
- CVE-2025-62963Medium
The Estatik plugin for WordPress (versions up to and including 4.3.1) is vulnerable to DOM-based Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This may allow execution of malicious script in the user's browser.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS