An authenticated attacker with Author or higher role can embed arbitrary JavaScript into FAQ content by submitting entity‑encoded payloads such as <img src=x onerror=alert()> . When the content is displayed, the plugin decodes the entities back into executable HTML while failing to apply proper output escaping, allowing the script to run in every visitor’s browser. This can lead to defacement, credential theft, session hijacking, or other malicious actions.

The vulnerability affects installations of the Ultimate FAQ Accordion Plugin from versions 2.4.7 and earlier, deployed on WordPress sites. The plugin registers a custom post type with REST API support and uses the default ‘post’ capability type, enabling Author users to create and publish FAQ posts.

The CVSS score of 6.4 indicates a moderate severity; the EPSS score is not available and the issue is not listed in the CISA KEV catalog. Exploitation requires only author‑level credentials, a common level of access in content‑management workflows, suggesting that once an author account is compromised or misused, the attack can be carried out during normal FAQ creation. The attack vector is likely via the REST API or the post‑editing interface, exploiting the lack of proper sanitization at display time.