The WP Accessibility plugin processes image alt text using JavaScript that reads the alt attribute with getAttribute() and then injects it directly into innerHTML or insertAdjacentHTML without sanitization, creating a DOM‑based cross‑site scripting flaw. If the Long Description UI is enabled and set to "Link to description", an attacker with Contributor-level privileges can store malicious script code in the alt field of any image. When a user visits a page that displays the compromised image, the script runs in the visitor’s browser, allowing the attacker to execute arbitrary JavaScript on that page.

WordPress installations running any version of the WP Accessibility plugin 2.3.1 or earlier from the vendor Joedolson are affected. The flaw exists in all builds that include the Long Description UI feature and is activated when the setting is set to "Link to description." Users with Contributor or higher roles can create an exploit, while other roles cannot modify the alt text and are therefore excluded.

The vulnerability is scored at CVSS 6.4, indicating medium severity, and its exploit probability is very low with an EPSS of less than 1%. The flaw is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with at least Contributor access, the Long Description UI setting enabled and set to "Link to description", and the ability to store a malicious alt attribute value. When a site visitor accesses a page that displays the compromised image, the injected script runs in the visitor’s browser, enabling the attacker to execute arbitrary JavaScript in that context. The impact is limited to the victim’s browser session and does not directly affect the server or other users beyond the page rendering.