CVE-2026-14230: ECS < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater Bindings
The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated only by a capability-agnostic nonce that any editposts user obtains from the Elementor editor), so a Contributor can write a data-source binding into any post — including admin-authored pages — whose attacker-controlled values are rendered into a widget's repeater output without sanitization, executing JavaScript in the session of any visitor or administrator who views the page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14230?
CVE-2026-14230 has a risk score of 62, indicating a moderate severity level.
How do I fix CVE-2026-14230?
To fix CVE-2026-14230, update the ECS WordPress plugin to version 4.3.8 or later.
What type of vulnerability is CVE-2026-14230?
CVE-2026-14230 is classified as a Stored XSS vulnerability.
Who is affected by CVE-2026-14230?
Users of the ECS WordPress plugin prior to version 4.3.8 are affected by CVE-2026-14230.
How does CVE-2026-14230 exploit the WordPress plugin?
CVE-2026-14230 exploits the lack of capability checks in Dynamic Repeater AJAX handlers, allowing unauthorized post modifications by Contributors.