The Elementor Content Switcher (ECS) WordPress plugin, in versions prior to 4.3.8, fails to verify user capability or ownership when handling Dynamic Repeater AJAX requests. A user with edit_posts capability—a contributor role—can inject an attacker‑controlled data‑source binding into any post. The binding’s value is later rendered inside a widget’s repeater output without sanitization, causing arbitrary JavaScript to execute in the browsers of any visitor or administrator who views the page, resulting in a stored cross‑site scripting (XSS) vulnerability.

The vulnerability affects the plugin named ‘ECS’ for WordPress, specifically any installation using a version earlier than 4.3.8. No additional version details are supplied beyond the pre‑4.3.8 range. The plugin is a consumer of the Elementor editor; any site that has the plugin and assigns edit_posts rights to users is susceptible.

The exploit path requires a user with edit_posts capability, which is a common role on WordPress sites. Since the only protection is a nonce that does not guard against non‑ownership, an attacker who can edit posts can craft a malicious repeater binding. The stored XSS will run in the context of every visitor or administrator who loads the affected page. The vulnerability has a CVSS score of 5.4, indicating moderate severity, and an EPSS score of < 1%, suggesting a low probability of exploitation. This issue is not listed in CISA’s KEV catalog, indicating no currently documented active exploitation. Nevertheless, the lack of input sanitization and the broad reach of the impact point to a medium‑risk vulnerability.