EUVD-2026-59588
GHSA-j628-rxpx-m866
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-accessible AJAX endpoint reachable by any Contributor (PR:L, AC:L); stored XSS fires in victim's browser context causing scope change (S:C); no availability impact; confidentiality and integrity limited to session data and post content.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
5DescriptionCVE.org
The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated only by a capability-agnostic nonce that any edit_posts user obtains from the Elementor editor), so a Contributor can write a data-source binding into any post - including admin-authored pages - whose attacker-controlled values are rendered into a widget's repeater output without sanitization, executing JavaScript in the session of any visitor or administrator who views the page.
AnalysisAI
Stored cross-site scripting in the ECS WordPress plugin before 4.3.8 allows a Contributor-level user to inject arbitrary JavaScript into any post - including administrator-authored pages - by exploiting missing authorization and object-ownership checks on the Dynamic Repeater AJAX handlers. The plugin gates these endpoints solely with a capability-agnostic nonce distributed through the Elementor editor, making them reachable by any edit_posts user who can then write unsanitized data-source bindings that execute in the browser of any visitor or administrator who views the affected page. No public exploit has been confirmed and EPSS sits at 0.15% (5th percentile), but the low privilege bar and potential to chain into admin account takeover make patching to 4.3.8 a straightforward and time-sensitive action.
Technical ContextAI
The ECS plugin extends the Elementor page builder by exposing Dynamic Repeater AJAX handlers that accept and render data-source bindings into widget output on the front end. The root cause is a compound flaw: CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) combined with broken access control. Nonce verification is performed, but the nonce itself is broadcast to all users who open the Elementor editor - including those with only the edit_posts capability (Contributor role) - without any additional capability check such as manage_options or edit_others_posts, and without validating that the requesting user owns the target post object. This means the AJAX handler effectively trusts any logged-in editor. The unsanitized attacker-controlled value is persisted in post meta or binding configuration and reflected into the repeater widget's front-end HTML output. Affected CPE per EUVD-2026-59588: ECS versions 0 through less than 4.3.8.
RemediationAI
Upgrade the ECS WordPress plugin to version 4.3.8 or later, the vendor-released patched version confirmed by WPScan (https://wpscan.com/vulnerability/fded2f21-d104-4dcb-8fd1-29db9866cabc/). If immediate upgrade is not possible, disable or restrict Contributor-level registration to prevent untrusted users from obtaining a valid nonce via the Elementor editor - note this may affect legitimate editorial workflows and should be coordinated with site editors. As a complementary measure, site administrators should audit all posts using Elementor Dynamic Repeater widgets for unexpected or modified data-source bindings, particularly on publicly accessible, high-visibility pages authored by administrators. Deploying a web application firewall rule to block unexpected AJAX requests to the affected Dynamic Repeater endpoints is a possible short-term control but requires care to avoid disrupting legitimate editor activity.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today