CVE-2026-18807

The ECS (Ele Custom Skin) WordPress plugin (versions before 4.3.8 ) is vulnerable to unauthorized actions due to a lack of capability or ownership checks on its dynamic repeater actions . The plugin incorrectly relies only on a nonce , which is accessible to any user capable of opening the page b...