EUVD-2026-22860Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Accessibly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API in all versions up to, and including, 3.0.3. The plugin registers REST API endpoints at /otm-ac/v1/update-widget-options and /otm-ac/v1/update-app-config with the permission_callback set to __return_true, which means no authentication or authorization check is performed. The updateWidgetOptions() function in AdminApi.php accepts user-supplied JSON data and passes it directly to AccessiblyOptions::updateAppConfig(), which saves it to the WordPress options table via update_option() without any sanitization or validation. The stored widgetSrc value is later retrieved by AssetsManager::enqueueFrontendScripts() and passed directly to wp_enqueue_script() as the script URL, causing it to be rendered as a <script> tag on every front-end page. This makes it possible for unauthenticated attackers to inject arbitrary JavaScript that executes for all site visitors by changing the widgetSrc option to point to a malicious external script.
AnalysisAI
Stored XSS in Accessibly WordPress plugin (≤3.0.3) allows unauthenticated attackers to inject malicious JavaScript executed by all site visitors via unprotected REST API endpoints. Two endpoints (/otm-ac/v1/update-widget-options and /otm-ac/v1/update-app-config) lack authentication checks (permission_callback set to __return_true), enabling attackers to modify the widgetSrc option with a URL pointing to attacker-controlled scripts. The malicious URL is stored unsanitized in WordPress options and
Technical ContextAI
This vulnerability exploits WordPress REST API security misconfigurations combined with improper output encoding. The Accessibly plugin (cpe:2.3:a:onthemapmarketing:accessibly_-_wordpress_website_accessibility) registers custom REST endpoints without implementing WordPress's standard capability checks. The permission_callback parameter controls access to REST routes-setting it to __return_true bypasses all authentication and authorization. The vulnerable code path: BaseApiController.php registers endpoints → AdminApi.php's updateWidgetOptions() accepts POST data → AccessiblyOptions::updateAppConfig() calls update_option() without sanitization → AssetsManager::enqueueFrontendScripts() retrieves the stored value and passes it to wp_enqueue_script(). This represents CWE-79 (Improper Neutralization of Input During Web Page Generation) at two critical points: input validation failure during storage and output encoding failure during script rendering. WordPress's wp_enqueue_script() function does not inherently sanitize URLs, relying on developers to validate input before storage. The attack leverages WordPress's options API as a persistent storage mechanism for malicious payloads.
RemediationAI
Update Accessibly plugin to version 3.0.4 or later immediately if a patched version has been released by OnTheMapMarketing (consult WordPress plugin repository or vendor directly to confirm current secure version, as fix version is not specified in provided data). Until patches are applied, disable the Accessibly plugin entirely to eliminate exposure-this is the only reliable mitigation since the vulnerability allows unauthenticated modification of critical settings. WordPress administrators should audit options table for suspicious widgetSrc values by checking wp_options for the accessibly configuration entries and verify no external script URLs have been injected. After updating, reset plugin configuration through the WordPress admin interface to ensure clean state. Implement Web Application Firewall rules blocking unauthorized POST requests to /wp-json/otm-ac/v1/update-widget-options and /wp-json/otm-ac/v1/update-app-config endpoints if immediate plugin removal is not feasible. Review server logs for requests to these endpoints from unexpected IP addresses to detect potential compromise. Detailed vulnerability disclosure with code references available at https://www.wordfence.com/threat-intel/vulnerabilities/id/f8234ea2-ff80-425f-b83d-29c422b40c6a?source=cve and WordPress plugin source at https://plugins.trac.wordpress.org/browser/otm-accessibly/.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today