CVE-2026-18988

Name of the Vulnerable Software and Affected Versions Easy Accordion versions prior to 3.1.9

Description Stored Cross-Site Scripting occurs when authenticated attackers with contributor-level access or higher inject arbitrary web scripts into pages. The issue stems from insufficient input sanitization and output escaping within the accordion header renderer() function. Specifically, the function uses esc attr() instead of tag escape() when processing the accordionTitleTag block attribute in an HTML tag-name context, allowing the execution of scripts whenever a user visits the affected page.

Recommendations Update Easy Accordion to version 3.1.9 or later. As a temporary mitigation, restrict access to the accordionTitleTag attribute for users with contributor-level permissions.