blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-14229

MEDIUM 5.3 CVSS 3.1
Published
August 15, 2026
Last modified
August 26, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-284
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished (private, draft, pending) documents by supplying their identifier.

Affected products and versions

  • Unknown ECS — Before 4.3.8

References

  • wpscan.com https://wpscan.com/vulnerability/52b44fc8-90af-45e4-a745-37e6369d8b6b/
  • nvd.nist.gov Official NVD record