Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: ECS 4.3.8 Clear all filters
TI-2026-12054 CVE-2026-14230 · GHSA-j628-rxpx-m866

ECS < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater Bindings

Priority MEDIUM 58

The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated only by a capability-agnostic nonce that any edit_posts user obtains from the Elem…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00226 Published 2026-08-15 Fixed in 4.3.8 CWE-79
TI-2026-12053 CVE-2026-14229 · GHSA-phww-7g4v-vrwj

ECS < 4.3.8 - Unauthenticated Private Content Disclosure via ecsload

Priority MEDIUM 63

The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the render…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00323 Published 2026-08-15 Fixed in 4.3.8 CWE-284