Lightweight Accordion Vulnerabilities

[en] The Lightweight Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `lightweight-accordion` shortcode in all versions up to, and including, 1.5.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

Affected:

up to 1.6.0

Fixed in:

1.6.0

Disclosed:

Dec 15, 2025

CVE-2025-13740 on NVD →

The Lightweight Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `lightweight-accordion` shortcode in all versions up to, and including, 1.5.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated att...

CVSS:

6.4

Affected:

up to 1.5.20

Fixed in:

1.6.0

Disclosed:

Dec 14, 2025

CVE-2025-13740 on NVD →

[en] The Lightweight Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.5.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with cont...

Affected:

up to 1.5.17

Fixed in:

1.5.17

Disclosed:

Apr 9, 2024

CVE-2024-2436 on NVD →

The Lightweight Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.5.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contribut...

CVSS:

6.4

Affected:

up to 1.5.16

Fixed in:

1.5.17

Disclosed:

Mar 22, 2024

CVE-2024-2436 on NVD →

[en] The Lightweight Accordion WordPress plugin before 1.5.15 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Affected:

up to 1.5.15

Fixed in:

1.5.15

Disclosed:

Feb 13, 2023

CVE-2023-0373 on NVD →

The Lightweight Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 1.5.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor l...

CVSS:

6.4

Affected:

up to 1.5.14

Fixed in:

1.5.15

Disclosed:

Jan 23, 2023

CVE-2023-0373 on NVD →