The Bellows Accordion Menu plugin does not properly escape or validate input stored in the accordion content. An attacker can submit a malicious script in the accordion title or description, which is then rendered on the front‑end for all visitors. Because the script runs with the page’s privileges, an attacker can hijack user sessions, hijack visitors’ cookies, inject additional malicious content, or redirect users to phishing sites. This is a traditional stored XSS flaw (CWE‑79) with a CVSS score of 6.5, indicating moderate severity.

WordPress sites that have the Bellows Accordion Menu plugin installed, specifically all releases from the first available version up to and including 1.4.3, are affected. The vulnerability is present in the plugin code, regardless of WordPress core version, so any WordPress deployment using this plugin in those versions is at risk.

The EPSS score is below 1%, which indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the administrator interface where users can add or edit accordion entries; an attacker would need the ability to submit content to those fields. Once the malicious payload is stored, every visitor to the page that displays the accordion will execute it. Given the CVSS score of 6.5, the risk is moderate, but the low EPSS score suggests that exploitation is currently uncommon.