# CVE-2026-14481: Equalize Digital Accessibility Checker Stored XSS in html parameter

Source: https://junglewise.ai/threats/cve-2026-14481-equalize-digital-accessibility-checker-stored-xss-in-html  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-14481 · Severity: medium · CVSS 6.4 · Published 2026-07-23

The Equalize Digital Accessibility Checker plugin for WordPress, which helps websites maintain legal accessibility compliance, contains a security flaw. An attacker with basic contributor-level access can inject malicious scripts into website pages. These scripts will automatically run in the browser of any user who visits the affected page, potentially leading to unauthorized actions or data theft.

Technologies: [Equalize Digital Accessibility Checker](https://junglewise.ai/threats/technologies/accessibility-checker). Vendors: [Equalize Digital](https://junglewise.ai/threats/vendors/equalize-digital).

## Quick answers

**Is CVE-2026-14481 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14481 being exploited in the wild.

**How severe is CVE-2026-14481?** Medium severity, with a CVSS score of 6.4, published 23 July 2026.

**Which products and versions are affected?** Equalize Digital Accessibility Checker <= 1.46.0.

**Is there a fix for CVE-2026-14481?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-14481 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-14481?** Check whether you run Equalize Digital Accessibility Checker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Equalize Digital Accessibility Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'html' parameter. The vulnerability is accessible via the REST API endpoint `/accessibility-checker/v1/post-scan-results/{id}`, which only requires the `edit_post` capability. Authenticated attackers with contributor-level access or higher can exploit this to inject arbitrary web scripts. These scripts are stored and will execute in the context of any user's browser session when they view the compromised post or page. The issue affects all versions up to and including 1.46.0.

## Affected products

- Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance <= 1.46.0

## Timeline

- 2026-07-23: disclosed: CVE published by Wordfence and NVD

## References

- [https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.44.1/admin/class-ajax.php](https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.44.1/admin/class-ajax.php)
- [https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.44.1/admin/class-insert-rule-data.php](https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.44.1/admin/class-insert-rule-data.php)
- [https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.44.1/includes/classes/class-rest-api.php](https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.44.1/includes/classes/class-rest-api.php)
- [https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.44.1/includes/helper-functions.php](https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.44.1/includes/helper-functions.php)
- [https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.45.0/admin/class-ajax.php](https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.45.0/admin/class-ajax.php)
- [https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.45.0/admin/class-insert-rule-data.php](https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.45.0/admin/class-insert-rule-data.php)
- [https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.45.0/includes/classes/class-rest-api.php](https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.45.0/includes/classes/class-rest-api.php)

## Related threats

- [Equalize Digital Accessibility Checker authorization bypass in REST API](https://junglewise.ai/threats/cve-2026-9199-equalize-digital-accessibility-checker-authorization-bypass-in)
- [Equalize Digital Accessibility Checker authorization bypass in AJAX handlers](https://junglewise.ai/threats/cve-2026-9015-equalize-digital-accessibility-checker-authorization-bypass-in)