CVE-2025-69350
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Stored XSS vulnerability in Accordion plugin (Themepoints) up to version 3.0.3. Improper input neutralization during web page generation allows persistent injection of malicious scripts.
Risk Assessment
An attacker can inject a persistent script that executes in users' browsers, potentially leading to data theft, session hijacking, or content modification.
Recommendation
Update the Accordion plugin to the latest version that fixes the Stored XSS vulnerability.
Other vulnerabilities in Accordion
See all- CVE-2026-66471Medium
Subscriber-level Cross Site Scripting (XSS) vulnerability in Accordion plugin versions up to and including 3.0.6.
- CVE-2025-53421Medium
The Accordion plugin from PickPlugins has a missing authorization vulnerability, allowing exploitation of incorrect access control security levels. Affects versions up to 2.3.14.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Accordion accordions-wp allows Stored XSS.This issue affects Accordion: from n/a through <= 3.0.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS