CVE-2026-3643

Name of the Vulnerable Software and Affected Versions Accessibly versions prior to 3.0.4

Description Stored Cross-Site Scripting (XSS) occurs via the REST API. The plugin registers endpoints '/otm-ac/v1/update-widget-options' and '/otm-ac/v1/update-app-config' without authentication or authorization checks. The updateWidgetOptions() function in AdminApi.php accepts user-supplied JSON data and passes it to AccessiblyOptions::updateAppConfig(), which saves the data to the WordPress options table via update option() without sanitization or validation. An unauthenticated attacker can change the widgetSrc variable to point to a malicious external script. This value is later retrieved by AssetsManager::enqueueFrontendScripts() and passed to wp enqueue script(), resulting in the execution of arbitrary JavaScript for all site visitors on every front-end page.

Recommendations Update to a version newer than 3.0.3.