WordPress Accordion CVE-2026-66471

Exploitation requires the attacker to hold at minimum a WordPress subscriber-level account on the target site (PR:L per CVSS), which is only obtainable if the site has open user registration enabled or the attacker has been granted an account by another means. A privileged user - typically an administrator or editor - must actively visit or preview the page containing the injected accordion content (UI:R per CVSS). Limiting factors: sites with closed registration (invite-only or no self-registration) are not exploitable remotely without pre-existing credentials; the Accordion plugin must be installed and active; and the injected content must be on a page that a privileged user is likely to view. The attack does not require any non-default server configuration beyond having the plugin installed and user registration open.

The CVSS 6.5 Medium score is generally appropriate for this class of vulnerability. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) shows low attack complexity with subscriber-level authentication required and mandatory victim interaction - these are meaningful limiting factors. The PR:L requirement means an attacker must obtain at least a subscriber account, which is only feasible on WordPress sites that permit public user registration. The UI:R component means exploitation is not fully autonomous - a privileged user must navigate to the poisoned page. No EPSS score is provided in the input data, and no KEV listing or public POC is reported, so real-world exploitation urgency is lower than a comparable unauthenticated stored XSS. The A:L (availability) metric in the official vector is atypical for XSS and is likely overstated; XSS does not generally cause availability loss to the server. Priority should be elevated for sites with open registration or multi-author environments where subscriber accounts are widely held.

An attacker registers a subscriber account on a WordPress site with public registration enabled, then navigates to the Accordion plugin's content editor and injects a JavaScript payload - such as a cookie-stealing script - into an accordion item title or body field. When a logged-in administrator later views the page containing the poisoned accordion, the script executes in their browser, exfiltrating the admin session cookie to an attacker-controlled endpoint and enabling full site takeover. No public POC has been identified at time of analysis, but the attack requires no special tooling beyond a browser.