Accordions Vulnerabilities

The Accordions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Accordion body field in all versions up to, and including, 2.3.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level access and above, to inject arbitra...

CVSS:

6.4

Affected:

up to 2.3.23

Fixed in:

2.3.25

Disclosed:

Jun 8, 2026

CVE-2026-10862 on NVD →

[en] Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion: from n/a through <= 2.3.14.

Affected:

up to 2.3.14

Fix:

No patched version reported

Disclosed:

Oct 22, 2025

CVE-2025-53421 on NVD →

The Accordion – AI FAQ, Accordion, Tabs, Image Accordion, Product FAQ, FAQ Builder, FAQ Grid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the get_post_data() function in all versions up to, and including, 2.3.15. This makes it possible for authenticated attackers, with...

CVSS:

4.3

Affected:

up to 2.3.15

Fixed in:

2.3.16

Disclosed:

Sep 22, 2025

CVE-2025-58678 on NVD →

The Accordion – AI FAQ, Accordion, Tabs, Image Accordion, Product FAQ, FAQ Builder, FAQ Grid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.3.14. This makes it possible for authenticated attackers, with Subscriber-level a...

CVSS:

4.3

Affected:

up to 2.3.14

Fixed in:

2.3.16

Disclosed:

Sep 16, 2025

CVE-2025-53421 on NVD →

[en] Deserialization of Untrusted Data vulnerability in PickPlugins Accordion allows Object Injection. This issue affects Accordion: from n/a through 2.3.10.

Affected:

up to 2.3.11

Fix:

No patched version reported

Disclosed:

Apr 11, 2025

CVE-2025-32143 on NVD →

The Accordion plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.3.11 via deserialization of untrusted input. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable s...

CVSS:

8.8

Affected:

up to 2.3.11

Fixed in:

2.3.12

Disclosed:

Apr 9, 2025

CVE-2025-32143 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PickPlugins Accordion accordions allows Stored XSS.This issue affects Accordion: from n/a through 2.2.99.

Affected:

up to 2.2.100

Fixed in:

2.2.100

Disclosed:

Oct 6, 2024

CVE-2024-47342 on NVD →

The Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.99 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that...

CVSS:

6.4

Affected:

up to 2.2.99

Fixed in:

2.2.100

Disclosed:

Sep 27, 2024

CVE-2024-47342 on NVD →

[en] The Accordion plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'accordions_duplicate_post_as_draft' function in all versions up to, and including, 2.2.96. This makes it possible for authenticated attackers, with contributor access a...

Affected:

up to 2.2.97

Fixed in:

2.2.97

Disclosed:

Apr 9, 2024

CVE-2024-1641 on NVD →

The Accordion plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'accordions_duplicate_post_as_draft' function in all versions up to, and including, 2.2.96. This makes it possible for authenticated attackers, with contributor access and ab...

CVSS:

5.4

Affected:

up to 2.2.96

Fixed in:

2.2.97

Disclosed:

Mar 13, 2024

CVE-2024-1641 on NVD →

The Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via parameter keys through accordion imports in versions up to, and including, 2.2.40 due to insufficient input sanitization and output escaping. This makes it possible for attackers with administrative privileges to inject arbitrary web sc...

CVSS:

5.5

Affected:

up to 2.2.40

Fixed in:

2.2.43

Disclosed:

Aug 17, 2022

The Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via parameter keys through accordion imports in versions up to, and including, 2.2.40 due to insufficient input sanitization and output escaping. This makes it possible for attackers with administrative privileges to inject arbitrary web sc...

Affected:

up to 2.2.43

Fixed in:

2.2.43

Disclosed:

Aug 17, 2022

[en] The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue.

Affected:

up to 2.2.30

Fixed in:

2.2.30

Disclosed:

May 14, 2021

CVE-2021-24283 on NVD →

The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue.

CVSS:

6.1

Affected:

up to 2.2.30

Fixed in:

2.2.30

Disclosed:

Apr 21, 2021

CVE-2021-24283 on NVD →

[en] An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action allowed any authenticated user with Subscriber or higher permissions the ability to import a new accordion and inject malicious JavaScript as part of the accordion.

Affected:

up to 2.2.9

Fixed in:

2.2.9

Disclosed:

May 28, 2020

CVE-2020-13644 on NVD →

An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action allowed any authenticated user with Subscriber or higher permissions the ability to import a new accordion and inject malicious JavaScript as part of the accordion.

CVSS:

6.4

Affected:

up to 2.2.9

Fixed in:

2.2.9

Disclosed:

Mar 18, 2020

CVE-2020-13644 on NVD →

Affected:

up to 2.3.16

Fixed in:

2.3.16

CVE-2025-58678 on NVD →