CVE-2025-53421

MediumCVSS 6.5

Published: 22/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

22th percentile - higher than 22% of all known CVEs

Summary

The Accordion plugin from PickPlugins has a missing authorization vulnerability, allowing exploitation of incorrect access control security levels. Affects versions up to 2.3.14.

Risk Assessment

Unauthorized users could modify accordion settings or access administrative functions, potentially compromising content integrity.

Recommendation

Update the plugin to the latest patched version.

Other vulnerabilities in Accordion

See all

CVE-2026-66471Medium
Subscriber-level Cross Site Scripting (XSS) vulnerability in Accordion plugin versions up to and including 3.0.6.
CVE-2025-69350Medium
Stored XSS vulnerability in Accordion plugin (Themepoints) up to version 3.0.3. Improper input neutralization during web page generation allows persistent injection of malicious scripts.

Original NVD description (English source)

Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion: from n/a through <= 2.3.14.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS