Css3 Accordions Vulnerabilities

The CSS3 Accordions for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a...

CVSS:

6.1

Affected:

up to 3.0

Fixed in:

3.1

Disclosed:

May 16, 2025

CVE-2025-31922 on NVD →

The CSS3 Accordions for WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 3.0

Fixed in:

3.1

Disclosed:

May 16, 2025

CVE-2025-31923 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in QuanticaLabs CSS3 Accordions for WordPress allows Stored XSS. This issue affects CSS3 Accordions for WordPress: from n/a through 3.0.

Affected:

up to 3.0

Fix:

No patched version reported

Disclosed:

May 16, 2025

CVE-2025-31922 on NVD →

[en] Missing Authorization vulnerability in QuanticaLabs CSS3 Accordions for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CSS3 Accordions for WordPress: from n/a through 3.0.

Affected:

up to 3.0

Fix:

No patched version reported

Disclosed:

May 16, 2025

CVE-2025-31923 on NVD →