Easy Accordion
Easy Accordion creates expandable accordion sections for organizing WordPress content.
Easy Accordion (easy-accordion-free) is a WordPress plugin with 2 published CVE records in this archive. The latest tracked vulnerability was published Aug 08, 2026; the highest published CVSS base score is 6.4.
easy-accordion-freeCVE-2026-18988: Easy Accordion title-tag block attribute permits Contributor stored XSS
Easy Accordion through 3.1.8 lets a Contributor store a crafted accordionTitleTag block attribute. accordion_header_renderer() used esc_attr() on that value even though it was inserted as an HTML tag name, which does not make an attacker-controlled tag name safe. The payload executes when the affected accordion is rendered, normally after a user with publishing rights reviews or publishes the Contributor's content. Version 3.1.9 restricts the attribute to allowed heading tags and applies tag-name escaping.
| Safe version |
|
||
|---|---|---|---|
| Aug 08, 2026 |
CVE-2026-18988
Easy Accordion title-tag block attribute permits Contributor stored XSS
Easy Accordion through 3.1.8 lets a Contributor store a crafted accordionTitleTag block attribute. accordion_header_renderer() used esc_attr() on that value even though it was inserted as an HTML tag name, which does not make an attacker-controlled tag name safe. The payload executes when the affected accordion is rendered, normally after a user with publishing rights reviews or publishes the Contributor's content. Version 3.1.9 restricts the attribute to allowed heading tags and applies tag-name escaping.
|
3.1.9 |
CVE6.4
|
| Jul 16, 2026 |
CVE-2026-15652
Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ: Cross-site scripting
Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 3.1.6.
|
3.1.7 |
CVE6.4
|