CVE-2026-14481

Name of the Vulnerable Software and Affected Versions Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress versions prior to 1.47.0

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to perform Stored Cross-Site Scripting (XSS). This occurs via the html parameter in the REST endpoint '/accessibility-checker/v1/post-scan-results/{id}', which is only protected by the edit post capability. An attacker with the ability to edit a post can inject arbitrary web scripts that execute when a user views the affected page.

Recommendations Update the plugin to a version later than 1.46.0. Avoid using the html parameter in the '/accessibility-checker/v1/post-scan-results/{id}' endpoint until the update is applied.