A Cross‑Site Request Forgery vulnerability in the CSS3 Accordions for WordPress plugin allows an attacker to cause a logged‑in user to submit a malicious request that stores arbitrary JavaScript in the plugin’s data. The stored script is then served to any visitor of the affected site, enabling client‑side code execution, defacement, or data exfiltration. This weakness is classified as CWE-352.

The vulnerability affects the CSS3 Accordions for WordPress plugin from QuanticaLabs, versions up to and including 3.0. Any installation of this plugin, regardless of the WordPress theme or other plugins, is potentially compromised if the version has not been updated beyond 3.0.

The CVSS base score of 7.1 denotes a high severity incident, while the EPSS score of less than 1% indicates a low yet non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a victim to be logged in and to visit a malicious URL that triggers the CSRF action, after which the injected script will persist for all future visitors. The impact is primarily client‑side, but attackers could use the stored XSS to steal session cookies or inject phishing content.