The Easy Accordion plugin for WordPress contains a stored cross‑site scripting flaw in versions up to 3.1.8. The flaw arises because the plugin renders the user‑supplied 'accordionTitleTag' value directly as an HTML tag name after applying esc_attr() instead of tag_escape(), which fails to escape the tag name in an HTML context. An attacker who can edit or create accordion blocks with contributor or higher permissions can inject arbitrary JavaScript. When a victim page loads, the injected script runs in the context of each site visitor, enabling credential theft, session hijacking, or defacement. This vulnerability is classified as CWE‑79.

WordPress sites that have the Easy Accordion plugin installed, with version 3.1.8 or earlier. The plugin is distributed by shapedplugin under the name "Easy Accordion – AI‑Powered FAQ & Accordion Blocks" for its FAQ product.

The CVSS score of 6.4 indicates moderate severity. The likely attack vector is an authenticated contributor‑level user modifying the accordion block within the WordPress dashboard; no remote network exploitation is required. The EPSS score is not available, so the current likelihood of exploitation is unknown, and the issue is not listed in the CISA KEV catalog, suggesting no confirmed exploitation yet.