Executive brief
The Accordion FAQ plugin for WordPress, used to create expandable question-and-answer sections on websites, is vulnerable to a security flaw that allows attackers to inject malicious scripts. If a site administrator or visitor clicks on a specially crafted link, an attacker could execute code in their browser, potentially leading to unauthorized actions, data theft, or website defacement. As of the latest report, no official patch has been released by the developer.
Technical details
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the UnboundStudio Accordion FAQ plugin for WordPress (versions <= 2.2.1) due to improper neutralization of user-supplied input during web page generation (CWE-79). An unauthenticated remote attacker can exploit this by tricking a user into clicking a malicious link or visiting a crafted URL. Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session, which can lead to session hijacking or administrative actions if the victim is an authenticated administrator. No official patch is currently available; users are advised to use web application firewalls or mitigation rules.
Affected products
- UnboundStudio (PressApps) Accordion FAQ up to 2.2.1
Timeline
- 2025-07-29: other: Vulnerability reported by researcher João Pedro S Alcântara
- 2025-08-28: advisory: Initial advisory published by Patchstack
- 2026-06-02: disclosed: CVE published to NVD dataset