CVE-2026-18988

The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to, and including, 3.1.8. This is due to insufficient input sanitization and output escaping in the accordion_header_renderer() function, which emits the attacker-supplied tag name using esc_attr() in an HTML tag-name context instead of tag_escape(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/easy-accordion-free/tags/3.1.2/Blocks/Includes/Render_Blocks_Template.php#L100
• https://plugins.trac.wordpress.org/browser/easy-accordion-free/tags/3.1.2/Blocks/Includes/Render_Blocks_Template.php#L126
• https://plugins.trac.wordpress.org/browser/easy-accordion-free/tags/3.1.2/Blocks/Includes/Render_Blocks_Template.php#L89
• https://plugins.trac.wordpress.org/browser/easy-accordion-free/tags/3.1.2/Blocks/Includes/block-attributes.php#L32
• https://plugins.trac.wordpress.org/changeset/3637700/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6a8a5b2b-6cb0-48bf-ba03-d23b1624390d?source=cve

Published

Aug 8, 2026

Last Modified

Aug 12, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1898A vulnerability was determined in WeKan up to 8.20. This aff…6.3
• CVE-2026-18980A vulnerability was identified in nearai ironclaw up to 0.29…6.3
• CVE-2026-18982A flaw was found in the RHOAI training-operator. This vulner…8.8
• CVE-2026-18983The One User Avatar | User Profile Picture plugin for WordPr…7.5
• CVE-2026-18985Incorrect Authorization vulnerability in Drupal Edit in-plac…8.1
• CVE-2026-18986Improper Neutralization of Input During Web Page Generation …4.8
• CVE-2026-1899The Any Post Slider plugin for WordPress is vulnerable to St…6.4
• CVE-2026-18990A vulnerability was detected in letta-ai LettaBot 0.2.0. Imp…7.3
• CVE-2026-18991A security vulnerability has been detected in nanocoai NanoC…7.3
• CVE-2026-18992A vulnerability was detected in zhayujie CowAgent up to 2.1.…6.3
• CVE-2026-18993A vulnerability was detected in NousResearch hermes-agent up…6.3
• CVE-2026-18994A potential improper authorization vulnerability was reporte…7.1