Threats tagged 'ghsa-357g-jxh5-c9w4'

The Essential Real Estate WordPress plugin versions prior to 5.3.6 contain a vulnerability where it does not properly verify allowed recipients for its contact email feature. This flaw permits users with the self-registered Customer role to add arbitrary email addresses to the allowlist, enabling unauthenticated users to send emails with attacker-controlled content through the site.