CVE-2026-18807

The ECS WordPress plugin before 4.3.8 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding...

CVE-2026-14230

The ECS (Ele Custom Skin) WordPress plugin versions before 4.3.8 is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the lack of capability or object-ownership checks on its Dynamic Repeater AJAX handlers , which are only protected by a capability-agnostic nonce obtaina...

EUVD-2026-59587

The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished private, draft, pending documents by supplying thei...

PT-2026-72162

The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers gated only by a capability-agnostic nonce that any edit posts user obtains from the Elementor editor, so a Contributor can write a data-source binding into any post —...