CVE-2026-14229 ECS < 4.3.8 - Unauthenticated Private Content Disclosure via ecsload

The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished private, draft, pending documents by supplying thei...

CVE-2026-14230 ECS < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater Bindings

The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers gated only by a capability-agnostic nonce that any editposts user obtains from the Elementor editor, so a Contributor can write a data-source binding into any post —...

CVE-2026-14230

The ECS WordPress plugin (specifically Ele Custom Skin for Elementor ) versions before 4.3.8 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a lack of capability or object-ownership checks on its Dynamic Repeater AJAX handlers . While these handlers are gated by a nonce, an...

CVE-2026-14230 ECS < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater Bindings

The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers gated only by a capability-agnostic nonce that any editposts user obtains from the Elementor editor, so a Contributor can write a data-source binding into any post —...

CVE-2026-14229

The ECS (Ele Custom Skin) for Elementor WordPress plugin versions before 4.3.8 is vulnerable to an unauthenticated private content disclosure via the ecsload functionality. The root cause is a failure to verify post status or user capabilities when rendering an Elementor document through an AJAX ...

CVE-2026-14229 ECS < 4.3.8 - Unauthenticated Private Content Disclosure via ecsload

The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished private, draft, pending documents by supplying thei...

EUVD-2026-59587

The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished private, draft, pending documents by supplying thei...

EUVD-2026-59588

The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers gated only by a capability-agnostic nonce that any editposts user obtains from the Elementor editor, so a Contributor can write a data-source binding into any post —...

CVE-2026-15993

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via 'username' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due to insufficient escaping on the user supplied...

CVE-2026-13360

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in all versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-13360 Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in all versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-13360 Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in all versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-13360

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in all versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-13360

The CVE-2026-13360 entry concerns the WordPress plugin “WPLP Cookie Consent” (GDPR/CCPA banner). A Stored Cross-Site Scripting vulnerability exists via the regionArray parameter in all versions up to 4.3.5 due to insufficient input sanitization and output escaping, enabling injection of scripts t...

CVE-2026-16145 Invisible Anti-Spam & CAPTCHA <= 5.1 - Unauthenticated Stored Cross-Site Scripting via 'action' Parameter

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 5.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15993 Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via 'username' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due to insufficient escaping on the user supplied...

CVE-2026-15993

The Form Maker by 10Web WordPress plugin (vulnerable up to 1.15.44) is affected by a blind SQL Injection in the Dynamic-Choice Field WHERE clause that references the {username} placeholder. Root cause: insufficient escaping of the user-supplied parameter and inadequate preparation of the existing...

CVE-2026-15001

The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions savebloyalconfigurationdata and savebloyalaccesskeyverificationdata being registered without any capability or...

CVE-2026-15303

The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the sixstoragecreatewpuser AJAX handler being registered on wpajaxnoprivsixstoragecreatewpuser without any nonce, capability, credential, or ownership...

CVE-2026-12128

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the cartdata parameter in all versions up to, and including, 2.9.9.6.8. This is due to the dopbspwoocommerceaddtocart AJAX action being registered via wpajaxnopriv with no authentication, no nonce...