What is the CVSS score of CVE-2026-15652?

CVE-2026-15652 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Easy Accordion CVE-2026-15652

EUVD-2026-44861 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-16 Wordfence

GHSA-prj2-8qrm-q9fc

WordPress XSS Wordpress Plugin Easy Accordion Ai Powered Faq Accordion Blocks Product Faq Shapedplugin

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS requires a victim to visit the injected page (UI:R corrected from vendor UI:N); contributor authentication required (PR:L); scope changes to victim browser (S:C); no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 03:48 vuln.today

CVE Published

Jul 16, 2026 - 02:30 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Easy Accordion - AI-Powered FAQ & Accordion Blocks, Product FAQ plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'align' Block Attribute in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Easy Accordion - AI-Powered FAQ & Accordion Blocks, Product FAQ plugin (all versions ≤ 3.1.6) enables authenticated attackers holding contributor-level WordPress roles to inject persistent JavaScript payloads via the unsanitized 'align' block attribute. The injected script executes in the browser of any user - including administrators - who views the affected page, making session hijacking and privilege escalation realistic follow-on impacts. No public exploit code or CISA KEV listing has been identified at time of analysis, but Wordfence source code references pinpoint the exact vulnerable lines, substantially lowering the barrier to exploitation.

Technical ContextAI

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the failure to sanitize and escape the 'align' attribute before rendering it into page HTML within the plugin's Gutenberg block rendering callback. The affected code is located in ShortcodeBlock.php at lines 127, 150, and 153 of the easy-accordion-free WordPress plugin (visible in the WordPress plugin trac repository under tags/3.1.5). WordPress Gutenberg blocks pass user-supplied attribute values to server-side PHP rendering functions; if these functions echo attribute values without WordPress-native sanitization functions such as esc_attr() or wp_kses_post(), arbitrary JavaScript can be persisted to the database and later reflected into page HTML. The affected product per CPE is cpe:2.3:a:shapedplugin:easy_accordion_-_ai-powered_faq_&_accordion_blocks,_product_faq:*:*:*:*:*:*:*:* confirming ShapedPlugin as the vendor. Exploitation is possible wherever the Gutenberg block editor is active (WordPress 5.0+).

RemediationAI

Update the Easy Accordion plugin to a version beyond 3.1.6 via the WordPress admin dashboard under Plugins → Updates, or via WP-CLI using wp plugin update easy-accordion-free. The upstream fix commit is referenced in the WordPress plugin changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3607006%40easy-accordion-free&new=3607006%40easy-accordion-free; however, the exact patched release version number is not confirmed in the available data - verify the current version in the WordPress Plugin Directory before deploying. If an immediate update is not possible, restrict contributor-level and above roles to trusted users only, or temporarily deactivate the Easy Accordion plugin; note that deactivation will remove accordion/FAQ blocks from frontend rendering until the plugin is restored. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/eb0fb0a7-b9f7-42db-b826-fc09090bd817?source=cve for the confirmed fixed version once formally published.