The Lightweight Accordion plugin suffers from a stored cross‑site scripting flaw that allows authenticated contributors or higher to embed arbitrary scripts via the plugin’s shortcode attributes. The plugin accepts user supplied attributes without proper sanitization or escaping, meaning malicious code can be persisted in the database and executed whenever a page containing the shortcode is rendered. This can lead to the theft of session cookies, credential compromise, and defacement or hijacking of the site for anyone who views the affected page.

WordPress sites that include the Lightweight Accordion plugin version 1.5.20 or earlier, distributed by the vendor someguy9. All installations of the plugin before the identified fixed version are vulnerable.

With a CVSS score of 6.4 the flaw is considered moderate in severity, and its EPSS score is below 1 %, indicating a very low probability of widespread exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to possess contributor‑level or higher access to insert the malicious shortcode. Once the content is stored, any user who views the affected page will have the injected script executed in their browser, making the risk primarily a cross‑site scripting threat to other site visitors rather than an arbitrary‑code execution vector.