5.4
Moyenne
CVE-2026-14230 The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater…
Description
The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated only by a capability-agnostic nonce that any edit_posts user obtains from the Elementor editor), so a Contributor can write a data-source binding into any post — including admin-authored pages — whose attacker-controlled values are rendered into a widget's repeater output without sanitization, executing JavaScript in the session of any visitor or administrator who views the page.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| ECS 4.3 | premières → < 4.3.8 | 4.3.8 |
Autres CVE de ECS
Les 4 CVE de ECS →
CVE-2026-19613
The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic…
6.5
Moyenne
CVE-2026-18807
The ECS WordPress plugin before 4.3.13 does not have capability or ownership checks on its dynamic repeater actions,…
4.3
Moyenne
CVE-2026-14229
The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor…
5.3
Moyenne