The Accordion FAQ plugin for WordPress suffers from a reflected Cross‑Site Scripting (XSS) flaw caused by improper neutralization of user input during web page generation; this is a CWE‑79 weakness that allows an attacker to inject arbitrary client‑side script into the page viewed by an affected user, potentially enabling cookie theft, session hijacking, malicious redirects, and defacement of the site.

The vulnerable product is the UnboundStudio Accordion FAQ WordPress plugin, with all versions up through 2.2.1 considered affected.

With a CVSS score of 7.1 the vulnerability is assessed as high severity; the EPSS score is not available and the issue is not listed in the CISA KEV catalog, indicating no publicly documented mass exploitation to date. Attackers can exploit the flaw remotely by delivering a crafted URL or form input that triggers the reflected XSS, thereby executing malicious JavaScript in the victim’s browser context.