Equalizedigital
Monthly
Stored Cross-Site Scripting in the Equalize Digital Accessibility Checker WordPress plugin (all versions through 1.46.0) permits authenticated contributors to inject persistent malicious scripts via the 'html' parameter of the plugin's REST API endpoint, which executes in the browser of any subsequent visitor to the affected post. The attack surface is the unguarded `/accessibility-checker/v1/post-scan-results/{id}` endpoint, protected only by the low-privilege `edit_post` WordPress capability, making exploitation trivial for any contributor-level account on multi-author sites. No public exploit has been identified and the plugin is absent from CISA KEV, but the low authentication bar and persistent payload nature elevate real-world risk beyond the medium CVSS score suggests for sites with multiple editors.
Authorization bypass in Equalize Digital Accessibility Checker for WordPress (all versions ≤ 1.42.1) allows authenticated author-level users to dismiss, ignore, or restore accessibility audit records belonging to posts they do not own. The flaw lies in the plugin's REST API handler accepting the attacker's own issue ID as a sufficient authorization token, and the `largeBatch=true` parameter then triggers a bulk operation that propagates the action across all site-wide issues sharing the same 'object' value - including those on administrator-owned posts. No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV; however, the Wordfence advisory includes direct source code references confirming the vulnerable logic.
Authorization bypass in the Equalize Digital Accessibility Checker WordPress plugin (all versions through 1.42.0) allows low-privileged authenticated users to corrupt accessibility audit integrity site-wide. Authenticated attackers holding subscriber-level accounts or higher can invoke AJAX endpoints in class-ajax.php to modify the ignore state, ignore reason, and ignore comment of any accessibility issue across the entire site, effectively hiding or dismissing audit findings they are not authorized to manage. The vulnerability is amplified by a mass-modification code path triggered when the largeBatch=true parameter is supplied, enabling bulk suppression of all findings sharing a common object identifier in a single request. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Equalize Digital Accessibility Checker WordPress plugin (all versions through 1.46.0) permits authenticated contributors to inject persistent malicious scripts via the 'html' parameter of the plugin's REST API endpoint, which executes in the browser of any subsequent visitor to the affected post. The attack surface is the unguarded `/accessibility-checker/v1/post-scan-results/{id}` endpoint, protected only by the low-privilege `edit_post` WordPress capability, making exploitation trivial for any contributor-level account on multi-author sites. No public exploit has been identified and the plugin is absent from CISA KEV, but the low authentication bar and persistent payload nature elevate real-world risk beyond the medium CVSS score suggests for sites with multiple editors.
Authorization bypass in Equalize Digital Accessibility Checker for WordPress (all versions ≤ 1.42.1) allows authenticated author-level users to dismiss, ignore, or restore accessibility audit records belonging to posts they do not own. The flaw lies in the plugin's REST API handler accepting the attacker's own issue ID as a sufficient authorization token, and the `largeBatch=true` parameter then triggers a bulk operation that propagates the action across all site-wide issues sharing the same 'object' value - including those on administrator-owned posts. No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV; however, the Wordfence advisory includes direct source code references confirming the vulnerable logic.
Authorization bypass in the Equalize Digital Accessibility Checker WordPress plugin (all versions through 1.42.0) allows low-privileged authenticated users to corrupt accessibility audit integrity site-wide. Authenticated attackers holding subscriber-level accounts or higher can invoke AJAX endpoints in class-ajax.php to modify the ignore state, ignore reason, and ignore comment of any accessibility issue across the entire site, effectively hiding or dismissing audit findings they are not authorized to manage. The vulnerability is amplified by a mass-modification code path triggered when the largeBatch=true parameter is supplied, enabling bulk suppression of all findings sharing a common object identifier in a single request. No public exploit code or CISA KEV listing has been identified at time of analysis.