CVE-2026-18988: Easy Accordion <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'accordionTitleTag' Block Attribute
The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to, and including, 3.1.8. This is due to insufficient input sanitization and output escaping in the accordionheaderrenderer() function, which emits the attacker-supplied tag name using escattr() in an HTML tag-name context instead of tagescape(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict WordPress contributor-level and above accounts that can edit pages/blocks to trusted users only to limit authenticated contributor+ ability to inject Stored XSS via the Easy Accordion 'accordionTitleTag' block attribute.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18988?
CVE-2026-18988 has a medium severity level of 6.4.
How do I fix CVE-2026-18988?
To fix CVE-2026-18988, update the Easy Accordion plugin to version 3.1.9 or later.
What is vulnerable in CVE-2026-18988?
CVE-2026-18988 affects the Easy Accordion plugin for WordPress, allowing for Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute.
What causes CVE-2026-18988?
CVE-2026-18988 is caused by insufficient input sanitization and output escaping in the accordion_header_renderer() function of the plugin.
What type of vulnerability is CVE-2026-18988?
CVE-2026-18988 is classified as a Stored Cross-Site Scripting (XSS) vulnerability.