The ECS WordPress plugin versions prior to 4.3.8 contain a CWE-79 Cross-Site Scripting vulnerability in its Dynamic Repeater AJAX handlers. These handlers lack proper capability and ownership checks and are gated only by a capability-agnostic nonce obtainable by users with edit_posts permission via the Elementor editor. Consequently, a Contributor user can inject malicious data-source bindings into posts, including admin-authored pages. The injected JavaScript is rendered unsanitized in widget repeater outputs, leading to script execution in the context of any visitor or administrator viewing the affected page.

An attacker with Contributor-level permissions can execute arbitrary JavaScript in the browsers of visitors and administrators viewing the compromised posts. This can lead to session hijacking, privilege escalation, or other client-side attacks. The vulnerability affects confidentiality and integrity but does not impact availability. The CVSS score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, user interaction required, and partial confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level users from accessing the affected Dynamic Repeater AJAX handlers or disable the ECS plugin if feasible. Monitor for updates from the vendor and apply patches promptly once released.