Description

The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to, and including, 3.1.8. This is due to insufficient input sanitization and output escaping in the accordion_header_renderer() function, which emits the attacker-supplied tag name using esc_attr() in an HTML tag-name context instead of tag_escape(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-08T05:17:06.790Z",
  "pubdate": "2026-08-08T05:17:06.790Z",
  "executiveSummary": "An authenticated Stored Cross-Site Scripting (XSS) vulnerability exists in the Easy Accordion plugin for WordPress in versions up to, and including, 3.1.8.\nThe flaw stems from insufficient input sanitization and improper output escaping within the accordion_header_renderer() function, specifically utilizing esc_attr() instead of tag_escape() in an HTML tag-name context.\nThis security deficiency allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts and malicious payloads into web pages via the 'accordionTitleTag' block attribute.\nWhen targeted pages containing the injected accordion components are accessed by visitors or administrators, the malicious script executes within the context of the victim's browser session.\nThis introduces significant risk implications, potentially enabling session hijacking, credential theft, redirection to malicious destinations, or unauthorized administrative actions performed on behalf of the victim.\nSuccessful exploitation requires authenticated access with a minimum privilege level of contributor, limiting external unauthenticated attacks but presenting substantial risk from compromised or malicious internal accounts.",
  "technicalDetails": "The root cause of this vulnerability lies in improper context-aware output escaping within the codebase of the Easy Accordion plugin, specifically inside the accordion_header_renderer() function.\nWhen rendering accordion headers via the Gutenberg block editor, the plugin processes the 'accordionTitleTag' block attribute to dynamically construct HTML heading tags.\nInstead of utilizing WordPress's dedicated tag_escape() function to ensure that only permitted HTML element names are rendered, the application incorrectly employs esc_attr().\nBecause esc_attr() is designed for attribute values rather than HTML tag-name contexts, it fails to neutralize malicious strings designed to break out of the tag structure.\nAttack vectors require an attacker to possess authenticated access with contributor-level privileges or higher, enabling them to create or edit posts and manipulate block attributes.\nThe attack flow proceeds as follows: First, the authenticated attacker crafts a malicious request modifying the 'accordionTitleTag' block attribute within a post or page containing the Easy Accordion block.\nUpon saving the post, the unsanitized and improperly escaped attribute is stored persistently in the database.\nSecond, when a victim requests the affected page, the server executes the vulnerable accordion_header_renderer() function to generate the HTML output.\nBecause the output mechanism fails to properly validate the tag context, the attacker-supplied payload is emitted directly into the Document Object Model (DOM).\nFinally, the injected arbitrary web script executes inside the browser of any user who accesses the injected page.\nPost-exploitation impact depends on the privileges of the victim viewing the page, ranging from standard user session compromise to potential privilege escalation if an administrator executes the malicious script."
}