Unknown Ecs vulnerabilities

4 CVEs affecting Unknown Ecs, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-19613, published 2026-08-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-19613, published 2026-08-16. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier,…
CVE-2026-14229, published 2026-08-15. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users…
CVE-2026-18807, published 2026-08-15. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The ECS WordPress plugin before 4.3.13 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder,…
CVE-2026-14230, published 2026-08-15. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated only by a capability-agnostic nonce that any edit_posts user…