CVE-2026-1808

Name of the Vulnerable Software and Affected Versions Orange Confort+ accessibility toolbar for WordPress plugin versions prior to 0.7

Description The Orange Confort+ accessibility toolbar for WordPress plugin is susceptible to Stored Cross-Site Scripting. This is due to insufficient input sanitization and output escaping in the style parameter of the ocplus button shortcode. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. The affected API endpoint is the ocplus button shortcode, and the vulnerable parameter is style.

Recommendations Update to a version newer than 0.7.