This vulnerability arises from insufficient sanitization of the 'align' block attribute in Easy Accordion, allowing authenticated contributors or higher users to store malicious JavaScript that executes whenever any visitor accesses the affected page. The flaw permits execution of arbitrary scripts in the browsers of anyone who views the page, representing a stored cross‑site scripting vulnerability (CWE‑79) that can compromise confidentiality, integrity, and availability of site visitors.

WordPress sites that have the Easy Accordion – AI‑Powered FAQ & Accordion Blocks plugin. The by shapedplugin. Only sites that use these plugin versions and have a user with contributor or higher privileges are susceptible.

The CVSS score of 6.4 indicates moderate risk. The EPSS score is less than 1%, suggesting a very low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to already possess contributor‑level or higher access to the WordPress site; the attack vector is authenticated through the plugin’s block editor. Once inside, the malicious code runs in the browsers of all visitors to the modified page.