What is the CVSS score of CVE-2026-18988?

CVE-2026-18988 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Easy Accordion CVE-2026-18988

EUVD-2026-54727 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-08 Wordfence

GHSA-fqqc-xqw4-9v56

WordPress XSS Wordpress Plugin Easy Accordion Ai Powered Faq Accordion Blocks Product Faq Shapedplugin

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS requires a victim to visit the injected page (UI:R), not UI:N; contributor auth (PR:L) required; scope change to browser; no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 08, 2026 - 04:57 vuln.today

CVE Published

Aug 08, 2026 - 04:25 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to, and including, 3.1.8. This is due to insufficient input sanitization and output escaping in the accordion_header_renderer() function, which emits the attacker-supplied tag name using esc_attr() in an HTML tag-name context instead of tag_escape(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Easy Accordion WordPress plugin (versions ≤ 3.1.8) enables authenticated contributors to persist malicious scripts in page content by supplying a crafted value for the accordionTitleTag block attribute. The accordion_header_renderer() function incorrectly uses WordPress's esc_attr() sanitizer - designed for HTML attribute values - when emitting a user-supplied tag name in an HTML tag-name context, where tag_escape() is required; this mismatch permits injection of arbitrary HTML elements and event handlers. No public exploit code or active exploitation has been confirmed at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

Easy Accordion is a WordPress Gutenberg block plugin by ShapedPlugin that renders accordion-style FAQ and content panels. The vulnerability resides in Blocks/Includes/Render_Blocks_Template.php (lines 89, 100, and 126 per plugin trac references), where accordion_header_renderer() processes the accordionTitleTag block attribute - the HTML heading tag (e.g., h2, h3) wrapping accordion titles. WordPress provides two distinct output-encoding functions: esc_attr(), which encodes for HTML attribute value context, and tag_escape(), which whitelists only valid HTML tag names. By applying esc_attr() in a tag-name context, the function fails to constrain input to allowed tag names and does not strip event handlers or exotic tag names, creating a DOM injection point. The block attribute definition is visible in block-attributes.php (line 32). The root cause maps to CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), specifically the subclass involving context-mismatched output encoding. Affected CPE: cpe:2.3:a:shapedplugin:easy_accordion_-_ai-powered_faq_&_accordion_blocks,_product_faq:*:*:*:*:*:*:*:*.

RemediationAI

Update the Easy Accordion plugin to a version above 3.1.8 via the WordPress admin dashboard (Plugins → Updates); the upstream fix is referenced by WordPress SVN changeset 3637700 at https://plugins.trac.wordpress.org/changeset/3637700/, though the exact patched release version number was not independently confirmed from available input data - administrators should verify the current published version in the WordPress plugin repository. Where immediate updates are not feasible, restrict contributor-level account creation and audit existing contributor accounts, since the vulnerability is not exploitable without at least contributor access. Block-level editor restrictions - via a block_editor_settings filter or a plugin such as Editor Blocks for Gutenberg - can disable the Accordion block for untrusted roles, eliminating the attack surface at the cost of restricting that content type for those users. Content Security Policy headers restricting inline script execution provide additional defense-in-depth but do not prevent the HTML injection itself.