Stored Cross-Site Scripting in JQuery Accordion Menu Widget for WordPress

CVE-2023-4890

Summary

The JQuery Accordion Menu Widget for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping on user-supplied attributes in the 'dcwp-jquery-accordion' shortcode. Authenticated attackers with contributor-level access or higher can exploit this vulnerability to inject arbitrary scripts into pages. These scripts execute whenever a user visits a compromised page, posing significant risks to site integrity and user security.

References