CVE-2025-52759

HighCVSS 7.1

Published: 02/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

The Accordion FAQ plugin by UnboundStudio versions up to 2.2.1 has a Reflected XSS vulnerability due to improper input neutralization during page generation. An attacker can inject malicious script via a crafted URL, which executes in the victim's browser.

Risk Assessment

Risk of session theft, redirection to malicious sites, or arbitrary actions in the user's context, potentially leading to data confidentiality breach.

Recommendation

Upgrade the Accordion FAQ plugin to the latest version that includes a fix for the XSS vulnerability.

Other vulnerabilities in Accordion FAQ

CVE-2025-58024High
PHP Remote File Inclusion vulnerability in the Accordion FAQ plugin for WordPress up to version 2.2.1. Allows PHP Local File Inclusion.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UnboundStudio Accordion FAQ allows Reflected XSS. This issue affects Accordion FAQ: from n/a through 2.2.1.