The Accessibly WordPress plugin registers REST API endpoints without authentication checks, enabling any visitor to submit JSON data that is stored as the widget source URL. The stored value is later passed directly to wp_enqueue_script, causing the browser to load and execute the script as a <script> tag on all front‑end pages. This results in unauthenticated stored XSS, giving an attacker the ability to run arbitrary JavaScript in the context of the site for all users, compromising confidentiality and integrity of site data and potentially leading to credential theft or defacement.

All sites running the Accessibly plugin from version 1.0.0 up to and including 3.0.3 are affected. The plugin is identified as onthemapmarketing:Accessibly – WordPress Website Accessibility. The vulnerability originates in files BaseApiController.php, AssetsManager.php, AccessiblyOptions.php, and AdminApi.php within the plugin code base.

The CVSS v3.1 score of 7.2 indicates a high severity. EPSS is not available, but the lack of authentication combined with stored XSS makes the attack path straightforward for an unauthenticated user who can reach the REST endpoints. The vulnerability is not listed in CISA’s KEV catalog, yet the ease of exploitation suggests that it could be commonly abused. Attackers can simply send a crafted HTTP POST to /otm-ac/v1/update-widget-options or /otm-ac/v1/update-app-config with a malicious widgetSrc URL, which will be executed for every visitor once stored.