Stored Cross-Site Scripting Vulnerability in Ultimate FAQ Accordion Plugin by WordPress

CVE-2026-4336

What is CVE-2026-4336?

The Ultimate FAQ Accordion plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to inadequate output sanitization. The vulnerability arises when the plugin retrieves FAQ content and uses the html_entity_decode() function, which translates HTML-encoded elements back into executable HTML without appropriate safety measures. This flaw allows authenticated users with Author-level access to inject harmful scripts into FAQ pages. When these pages are accessed by users, the injected scripts can execute, compromising the security of the site. The issue is exacerbated as the ufaq custom post type is registered with REST API access, making it easier for attackers to exploit the vulnerability.

References