What is GHSA-qm9j-xm9j-x4x3?

GHSA-qm9j-xm9j-x4x3 is a security advisory published by GitHub Security Advisories with Medium severity. The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX...

Which CVE IDs does GHSA-qm9j-xm9j-x4x3 cover?

GHSA-qm9j-xm9j-x4x3 covers the following CVE IDs: CVE-2026-90966. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qm9j-xm9j-x4x3?

GHSA-qm9j-xm9j-x4x3 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-qm9j-xm9j-x4x3MediumCVSS 4.3

The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX...

Vendor

GitHub Security Advisories

Published

November 5, 2026

Last Modified

November 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-90966 →

📋 Description

The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing package selected for free activation is genuinely free or that the requesting user is entitled to it, allowing a self-registered customer to activate a paid package without payment and cause the site to record a paid invoice at the package's full price.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-90966
https://wpscan.com/vulnerability/445a0351-d452-412e-8145-d427e10e0948
https://github.com/advisories/GHSA-qm9j-xm9j-x4x3