Stored Cross-Site Scripting Vulnerability in Easy Accordion Plugin for WordPress
CVE-2026-18988

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Easy Accordion – Ai-powered Faq & Accordion Blocks, Product Faq
Vendor
CVE Published:
8 August 2026

What is CVE-2026-18988?

The Easy Accordion plugin for WordPress is susceptible to a Stored Cross-Site Scripting issue stemming from the 'accordionTitleTag' block attribute. This vulnerability arises from inadequate input sanitization and output escaping, particularly in the accordion_header_renderer() function. Attackers with contributor-level access can exploit this to inject arbitrary scripts into web pages, which execute when users access those pages. This presents a significant risk to site integrity, especially for sites utilizing this outdated version of the plugin.

Affected Version(s)

Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ 0 <= 3.1.8

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/easy-accordion...
https://plugins.trac.wordpress.org/browser/easy-accordion...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Romain Deperne (ang3L)
.