The wA11y – The Web Accessibility Toolbox plugin accepts user input that is not sanitized and stores it for later display on web pages, enabling a malicious actor to embed persistent JavaScript. When visitors load the affected content, the injected script runs in their browsers, which can lead to credential theft, site defacement, or redirection to malicious sites. This flaw is a CWE‑79 type vulnerability.

All releases of the WordPress plugin Rachel Cherry wA11y – The Web Accessibility Toolbox through version 1.0.3, including any older or default installations, are affected.

The CVSS score of 5.9 indicates medium severity. The EPSS score of less than 1% suggests attacks are rare at present, and the weakness is not listed in the CISA KEV catalog. An attacker would need to create or edit plugin content, which typically requires administrative or privileged user access, to inject persistent payloads. No publicly documented exploits have been reported as of the latest information.