Stored Cross-Site Scripting Vulnerability in Accessibly Plugin for WordPress

CVE-2026-3643

What is CVE-2026-3643?

The Accessibly plugin for WordPress exposes a Stored Cross-Site Scripting vulnerability through its REST API. This flaw allows unauthenticated attackers to insert malicious JavaScript into the site. The plugin's endpoints, /otm-ac/v1/update-widget-options and /otm-ac/v1/update-app-config, fail to require authentication or authorization, enabling any user to provide arbitrary JSON data. This data is improperly handled, as it is directly saved to the WordPress options table without validation or sanitization. As a result, the widgetSrc option can be manipulated to load malicious scripts on every frontend page visited, compromising site integrity and security for all users.

References