CVE-2026-14230

The CVE-2026-14230 entry describes a Stored XSS flaw in the ECS WordPress plugin (affected: versions before 4.3.8). The vulnerability arises because Dynamic Repeater AJAX handlers do not perform proper capability or object-ownership checks; access is gated only by a capability-agnostic nonce obta...

EUVD-2026-59587

The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished private, draft, pending documents by supplying thei...