The Accordions plugin contains an input validation flaw that allows an authenticated user with Custom‑level access or higher to inject malicious JavaScript into the accordion body field. The payload is persisted in the database and is rendered on every page where the accordion appears, causing the injected script to run in the browser context of any site visitor. This can be used to steal session cookies, deface the site, or redirect users to phishing pages.

WordPress sites that have the Accordions plugin (pickplugins:Accordions) deployed, specifically versions up to and including 2.3.23. If the site uses a role with Custom+ privileges, that user can add the malicious payload to an accordion element.

The CVSS score of 6.4 reflects a medium severity risk, and the vulnerability is not listed in the CISA KEV catalog. While the EPSS score is not available, the requirement for authenticated Custom+ access limits the attack surface to users who already have significant privileges. An attacker who can access the edit interface can immediately inject a payload, which will then be executed for all users who view the modified accordion. The medium severity score and the required privilege level imply a moderate risk that should be addressed promptly.