5.4
Medium
CVE-2026-14230 The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater…
Description
The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated only by a capability-agnostic nonce that any edit_posts user obtains from the Elementor editor), so a Contributor can write a data-source binding into any post — including admin-authored pages — whose attacker-controlled values are rendered into a widget's repeater output without sanitization, executing JavaScript in the session of any visitor or administrator who views the page.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ECS 4.3 | earliest → < 4.3.8 | 4.3.8 |
Other CVEs of ECS
The 4 CVEs of ECS →
CVE-2026-19613
The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic…
6.5
Medium
CVE-2026-18807
The ECS WordPress plugin before 4.3.13 does not have capability or ownership checks on its dynamic repeater actions,…
4.3
Medium
CVE-2026-14229
The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor…
5.3
Medium