EUVD-2026-59592

The ECS WordPress plugin before 4.3.8 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding...

CVE-2026-14230

The CVE-2026-14230 entry describes a Stored XSS flaw in the ECS WordPress plugin (affected: versions before 4.3.8). The vulnerability arises because Dynamic Repeater AJAX handlers do not perform proper capability or object-ownership checks; access is gated only by a capability-agnostic nonce obta...