The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The ECS WordPress plugin before 4.3.13 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding configuration of posts they do not own and to change the ECS WordPress plugin before 4.3.13's site-wide presets.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ele Custom Skin Plugin | — | Update ele-custom-skin plugin to version 4.3.8, or a newer patched version | Oct 30, 2026 | Aug 13, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub