Vulnerabilities and security researches forele-custom-skin

CVE, Research URL: CVE-2026-14229
Home page URL: Security reports for Elementor Custom Skin
Application: Elementor Custom Skin
Date: Aug 15, 2026
Research Description: The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished (private, draft, pending) documents by supplying their identifier.
Affected versions: max 4.3.8.
Status: vulnerable

CVE, Research URL: CVE-2026-19613
Home page URL: Security reports for Elementor Custom Skin
Application: Elementor Custom Skin
Date: Aug 16, 2026
Research Description: The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post metadata from posts they do not own, including private and draft ones.
Affected versions: max 4.3.10.
Status: vulnerable

CVE, Research URL: CVE-2026-14230
Home page URL: Security reports for Elementor Custom Skin
Application: Elementor Custom Skin
Date: Aug 15, 2026
Research Description: The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated only by a capability-agnostic nonce that any edit_posts user obtains from the Elementor editor), so a Contributor can write a data-source binding into any post — including admin-authored pages — whose attacker-controlled values are rendered into a widget's repeater output without sanitization, executing JavaScript in the session of any visitor or administrator who views the page.
Affected versions: max 4.3.8.
Status: vulnerable

CVE, Research URL: CVE-2026-18807
Home page URL: Security reports for Elementor Custom Skin
Application: Elementor Custom Skin
Date: Aug 15, 2026
Research Description: The ECS WordPress plugin before 4.3.8 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding configuration of posts they do not own and to change the ECS WordPress plugin before 4.3.8's site-wide presets.
Affected versions: max 4.3.8.
Status: vulnerable

Vulnerabilities and security researches forele-custom-skin ele-custom-skin