Cross-site Scripting Vulnerability in Bellows Accordion Menu by Sevenspark

CVE-2025-49242

What is CVE-2025-49242?

The Bellows Accordion Menu plugin by Sevenspark contains a vulnerability that enables attackers to exploit improper input neutralization during web page generation, leading to Stored XSS. This security flaw allows malicious scripts to be injected and stored on the server, potentially affecting users who interact with the compromised interface. The issue has been identified in versions ranging from n/a up to 1.4.3, necessitating immediate attention to secure applications utilizing this plugin.

References