Ele Custom Skin Vulnerabilities

The ECS – Ele Custom Skin for Elementor plugin for WordPress is vulnerable to unauthorized access in all versions up to 4.3.10. This is due to a missing capability check on a function. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 4.3.10

Fixed in:

4.3.10

Disclosed:

Aug 20, 2026

CVE-2026-19613 on NVD →

The ECS plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.3.7. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages tha...

CVSS:

6.4

Affected:

up to 4.3.7

Fixed in:

4.3.8

Disclosed:

Aug 13, 2026

CVE-2026-14230 on NVD →

The ECS plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 4.3.7. This is due to missing visibility checks on the theme_id and post_id parameters in the wp_ajax_nopriv_ecsload handler before loading and returning Elementor document data. This makes it possible for unauthenticate...

CVSS:

5.3

Affected:

up to 4.3.7

Fixed in:

4.3.8

Disclosed:

Aug 13, 2026

CVE-2026-14229 on NVD →