Plugin security history

Essential Real Estate Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 14 vulnerability records associated with Essential Real Estate, published between 2019 and 2025.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

14Total records

2Critical

1High

11Medium

0Low

0Informational

11Patched records

3Currently marked unpatched

2019-06-29First disclosure

2025-12-14Latest disclosure

12 of 14CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2019	1	1 records
2022	2	2 records
2023	3	3 records
2024	3	3 records
2025	5	5 records

Severity Breakdown

Severity	Records	Share
Critical	2	14.3%
High	1	7.1%
Medium	11	78.6%

Vulnerability-Type Breakdown

Cross-Site Scripting

5 records35.7%

First: 2019. Latest: 2024.

Missing Authorization

4 records28.6%

First: 2023. Latest: 2025.

Other

2 records14.3%

First: 2025. Latest: 2025.

Arbitrary File Upload

1 record7.1%

First: 2023. Latest: 2023.

Information Disclosure

1 record7.1%

First: 2024. Latest: 2024.

CSRF

1 record7.1%

First: 2025. Latest: 2025.

Patch Status

Patched: 11
Currently marked unpatched: 3
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

5.2.1
5.1.9
5.1.7
4.4.5
4.4.3
4.4.0
4.0.0
3.9.6
1.7.2

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-5.2.2`	Essential Real Estate <= 5.2.2 - Authenticated (ERE Customer+) Insecure Direct Object Reference	December 14, 2025	Not supplied	Medium
`*-5.2.2`	Essential Real Estate <= 5.2.2 - Missing Authorization	December 14, 2025	Not supplied	Medium
`*-5.2.1`	Essential Real Estate <= 5.2.1 - Unauthenticated Local File Inclusion	May 21, 2025	Not supplied	Critical
`*-5.2.0`	Essential Real Estate <= 5.2.0 - Unauthenticated Local File Inclusion	March 27, 2025	5.2.1	Critical
`*-5.1.8`	Essential Real Estate <= 5.1.8 - Cross-Site Request Forgery	January 24, 2025	5.1.9	Medium
`*-5.1.6`	Essential Real Estate <= 5.1.6 - Missing Authorization to Authenticated (Contributor+) Information Exposure	December 11, 2024	5.1.7	Medium
`*-4.4.4`	Essential Real Estate <= 4.4.2 - Insecure Direct Object Reference to Arbitrary Attachment Deletion	June 3, 2024	4.4.5	Medium
`*-4.4.2`	Essential Real Estate <= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	June 3, 2024	4.4.3	Medium
`*-4.3.5`	Essential Real Estate <= 4.3.5 - Missing Authorization to Stored Cross-Site Scripting	December 18, 2023	4.4.0	Medium
`*-4.3.5`	Essential Real Estate <= 4.3.5 - Missing Authorization to Denial of Service	December 18, 2023	4.4.0	Medium
`*-4.3.5`	Essential Real Estate <= 4.3.5 - Authenticated (Subscriber+) Arbitrary File Upload	December 14, 2023	4.4.0	High
`*-3.9.6`	Essential Real Estate <= 3.9.6 - Reflected Cross-Site-Scripting	December 5, 2022	4.0.0	Medium
`*-3.9.5`	Essential Real Estate <= 3.9.5 - Reflected Cross-Site-Scripting	November 17, 2022	3.9.6	Medium
`[*, 1.7.2)`	Essential Real Estate <= 1.7.1 - Reflected Cross-Site Scripting	June 29, 2019	1.7.2	Medium

Selected source records

Latest Records

MediumCVE-2025-66127

Essential Real Estate <= 5.2.2 - Missing Authorization

Published: December 14, 2025

Affected versions: *-5.2.2
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2025-68071

Essential Real Estate <= 5.2.2 - Authenticated (ERE Customer+) Insecure Direct Object Reference

Published: December 14, 2025

Affected versions: *-5.2.2
Patched versions: Not supplied

Original Wordfence record

CriticalCVE-2025-48126

Essential Real Estate <= 5.2.1 - Unauthenticated Local File Inclusion

Published: May 21, 2025

Affected versions: *-5.2.1
Patched versions: Not supplied

Original Wordfence record

CriticalCVE-2025-30849

Essential Real Estate <= 5.2.0 - Unauthenticated Local File Inclusion

Published: March 27, 2025

Affected versions: *-5.2.0
Patched versions: 5.2.1

Original Wordfence record

MediumCVE-2025-24698

Essential Real Estate <= 5.1.8 - Cross-Site Request Forgery

Published: January 24, 2025

Affected versions: *-5.1.8
Patched versions: 5.1.9

Original Wordfence record

MediumCVE-2024-12329

Essential Real Estate <= 5.1.6 - Missing Authorization to Authenticated (Contributor+) Information Exposure

Published: December 11, 2024

Affected versions: *-5.1.6
Patched versions: 5.1.7

Original Wordfence record

MediumCVE-2024-4274

Essential Real Estate <= 4.4.2 - Insecure Direct Object Reference to Arbitrary Attachment Deletion

Published: June 3, 2024

Affected versions: *-4.4.4
Patched versions: 4.4.5

Original Wordfence record

MediumCVE-2024-4273

Essential Real Estate <= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published: June 3, 2024

Affected versions: *-4.4.2
Patched versions: 4.4.3

Original Wordfence record

Highest-Severity Records

CriticalCVE-2025-48126

Essential Real Estate <= 5.2.1 - Unauthenticated Local File Inclusion

Published: May 21, 2025

Affected versions: *-5.2.1
Patched versions: Not supplied

Original Wordfence record

CriticalCVE-2025-30849

Essential Real Estate <= 5.2.0 - Unauthenticated Local File Inclusion

Published: March 27, 2025

Affected versions: *-5.2.0
Patched versions: 5.2.1

Original Wordfence record

HighCVE-2023-6827

Essential Real Estate <= 4.3.5 - Authenticated (Subscriber+) Arbitrary File Upload

Published: December 14, 2023

Affected versions: *-4.3.5
Patched versions: 4.4.0

Original Wordfence record

MediumCVE-2023-6141

Essential Real Estate <= 4.3.5 - Missing Authorization to Stored Cross-Site Scripting

Published: December 18, 2023

Affected versions: *-4.3.5
Patched versions: 4.4.0

Original Wordfence record

MediumCVE-2024-4273

Essential Real Estate <= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published: June 3, 2024

Affected versions: *-4.4.2
Patched versions: 4.4.3

Original Wordfence record

Medium

Essential Real Estate <= 3.9.6 - Reflected Cross-Site-Scripting

Published: December 5, 2022

Affected versions: *-3.9.6
Patched versions: 4.0.0

Original Wordfence record

MediumCVE-2022-3933

Essential Real Estate <= 3.9.5 - Reflected Cross-Site-Scripting

Published: November 17, 2022

Affected versions: *-3.9.5
Patched versions: 3.9.6

Original Wordfence record

Medium

Essential Real Estate <= 1.7.1 - Reflected Cross-Site Scripting

Published: June 29, 2019

Affected versions: [*, 1.7.2)
Patched versions: 1.7.2

Original Wordfence record

Currently Marked Unpatched Records

MediumCVE-2025-66127

Essential Real Estate <= 5.2.2 - Missing Authorization

Published: December 14, 2025

Affected versions: *-5.2.2
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2025-68071

Essential Real Estate <= 5.2.2 - Authenticated (ERE Customer+) Insecure Direct Object Reference

Published: December 14, 2025

Affected versions: *-5.2.2
Patched versions: Not supplied

Original Wordfence record

CriticalCVE-2025-48126

Essential Real Estate <= 5.2.1 - Unauthenticated Local File Inclusion

Published: May 21, 2025

Affected versions: *-5.2.1
Patched versions: Not supplied

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory