Immocaster WordPress Plugin
Immocaster WordPress Plugin has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 8.1, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is PHP Remote File Inclusion, behind 1 of the records (100%).
The one issue recorded for Immocaster WordPress Plugin has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by ArilAprilio. Immocaster WordPress Plugin is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 3.9.0.
CVE-2025-60190Immocaster WordPress <= 1.3.6 - Unauthenticated Local File Inclusion
Read the full analysisVulnerability Records
Immocaster WordPress Plugin
Author
Hinnerk Altenburg
Dieses Plugin nutzt das Immocaster-SDK (https://github.com/ImmobilienScout24/restapi-php-sdk) um sich mir der API von ImmobilienScout24 zu verbinden und wurde speziell für Makler und Regionale Blog entwickelt. Es ermöglicht das Auslesen von Daten von ImmobilienScout24 um diese auf dem eigenen Blog anzeigen zu lassen. ACHTUNG: Der Aufruf von Maklerobjekten bzw. eigenen Objekten ist nicht mit einem Basis-Account von ImmobilienScout24 möglich.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C