CVE-2023-25962 MEDIUM

CVE-2023-25962: WordPress Accordions Plugin <= 2.3.0 is vulnerable to Cross Site Scripting (XSS)

Vendor Biplob Adhikari
Product Accordion – Multiple Accordion or FAQs Builder
Weakness CWE-79 · XSS
Published May 4, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.9/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Biplob Adhikari Accordion – Multiple Accordion or FAQs Builder plugin <= 2.3.0 versions.

Explanation of Vulnerability in Simple Terms

02Summary

The Accordion plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to 2.3.0. An authenticated user with high privileges can inject malicious JavaScript into accordion content. When other users view the affected page, the script executes in their browser, potentially stealing session data or performing actions on their behalf. The vulnerability requires user interaction to trigger.

What an attacker can do

03Attacker Capabilities

Inject JavaScript that runs in visitors' browsers when they view accordion content.

Potential impact on your site

04Site Impact

Malicious admins or compromised high-privilege accounts can inject scripts affecting all site visitors viewing accordions.

Conditions required to exploit

05Prerequisites

Attacker must have high-level WordPress account access (admin or editor role) and a user must view the affected accordion.

Key dates

06Disclosure timeline

May 4, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-65533 WordPress Smart SEO Tool plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability CVE-2026-17162 WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'currentPostId' Block Attribute CVE-2026-65518 WordPress Accept Donations with PayPal & Stripe plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability CVE-2026-15648 Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute CVE-2026-13362 SendPulse Email Marketing Newsletter <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via _sp_form_code Post Meta