EUVD-2026-57889
GHSA-vhmj-c5j6-939q
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
A:N replaces A:L from the official vector because stored XSS does not cause server-side availability loss; all other metrics are consistent with subscriber-initiated stored XSS requiring victim interaction.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Subscriber Cross Site Scripting (XSS) in Accordion <= 3.0.6 versions.
AnalysisAI
Stored Cross-Site Scripting in the Accordion WordPress plugin (versions <= 3.0.6) allows authenticated subscriber-level users to inject malicious JavaScript into accordion content fields, which then executes in the browser of any higher-privileged user who views the affected page. The scope change (S:C in CVSS) confirms the attack pivots from the subscriber's input to the victim's browsing session, enabling session hijacking, credential theft, or unauthorized admin actions. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and subscriber-level access requirement make this a realistic threat on sites with open user registration.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes insufficient output encoding of user-supplied data before rendering in a browser context. The affected product, identified via CPE cpe:2.3:a:themepoints:accordion:*:*:*:*:*:*:*:*, is a WordPress plugin by ThemePoints that provides collapsible accordion UI components. The vulnerability originates from the plugin's failure to sanitize or escape subscriber-controlled input - such as accordion item titles or body text - prior to rendering it in the page HTML. Because WordPress subscriber accounts have limited trust by design, any plugin that grants them write access to fields later reflected in the DOM without proper escaping creates a stored XSS surface. The scope change (S:C) indicates the injected payload executes in the victim's browser security context rather than the server's, which is characteristic of client-side XSS payloads.
RemediationAI
Update the Accordion plugin to the first version released after 3.0.6 as soon as one is available from the WordPress plugin repository or ThemePoints directly; no specific patched version number is confirmed from the available input data, so administrators should verify the current release via the WordPress admin dashboard or the Patchstack advisory at the reference URL. As an interim compensating control, disable public user registration (Settings > General > uncheck 'Anyone can register') to eliminate the subscriber-level account creation vector, accepting the trade-off that legitimate self-registration is blocked. Alternatively, restrict accordion content editing capabilities to Editor-level or higher roles via a role management plugin such as Members or User Role Editor, which limits which users can submit the vulnerable fields. Deploying a web application firewall rule that blocks common XSS payloads in POST parameters to the plugin's save endpoints can add a detection and blocking layer but is not a substitute for patching.
The Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tcpaccordion' shortcod
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Accord
The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, lead
An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. Rated medium severity (CVSS 5.4), this vulne
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today