CVE-2026-66471
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Subscriber-level Cross Site Scripting (XSS) vulnerability in Accordion plugin versions up to and including 3.0.6.
Risk Assessment
A subscriber can inject malicious scripts that execute in other users' browsers, potentially leading to session theft or other attacks.
Recommendation
Update the Accordion plugin to a version newer than 3.0.6.
Other vulnerabilities in Accordion
See all- CVE-2025-69350Medium
Stored XSS vulnerability in Accordion plugin (Themepoints) up to version 3.0.3. Improper input neutralization during web page generation allows persistent injection of malicious scripts.
- CVE-2025-53421Medium
The Accordion plugin from PickPlugins has a missing authorization vulnerability, allowing exploitation of incorrect access control security levels. Affects versions up to 2.3.14.
Original NVD description (English source)
Subscriber Cross Site Scripting (XSS) in Accordion <= 3.0.6 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS