EUVD-2026-59913

The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post...

CVE-2026-19613

The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post...

CVE-2026-18807

The ECS WordPress plugin before 4.3.8 is vulnerable due to missing capability/ownership checks on dynamic repeater actions; it relies solely on a nonce accessible to any user who can open the page builder. This allows users with a contributor-level account or higher to read, alter, and delete bin...

EUVD-2026-59592

The ECS WordPress plugin before 4.3.8 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding...

CVE-2026-14229

CVE-2026-14229: Affects ECS WordPress plugin versions before 4.3.8. The plugin does not validate post status or capabilities when rendering an Elementor document via AJAX, allowing unauthenticated users to retrieve rendered content of unpublished (private, draft, pending) documents by supplying t...

EUVD-2026-59588

The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers gated only by a capability-agnostic nonce that any editposts user obtains from the Elementor editor, so a Contributor can write a data-source binding into any post —...