The Equalize Digital Accessibility Checker plugin for WordPress contains a stored cross‑site scripting flaw triggered by the html parameter used in several admin endpoints. Authenticated users with contributor level rights or higher can supply malicious JavaScript through this parameter, which is then stored in the post data. When any visitor loads the affected post, the injected script executes in their browser, potentially stealing session cookies, defacing content, or issuing further network requests. The vulnerability is a classic reflected input flaw exacerbated by insufficient sanitization and output escaping, and it is classified as CWE‑79.

WordPress sites that have installed the Equalize Digital Accessibility Checker plugin version 1.46.0 or older are impacted. All releases up to and including 1.46.0 are affected; the plugin is freely available from the official WordPress plugin repository.

The situation is rated with a CVSS score of 6.4, indicating medium severity. The EPSS score is below 1 %, implying that widespread exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to possess the edit_post capability on a target post, which contributors and higher roles have by default, so the attack vector is moderately accessible on sites that permit broad content editing.