Real Accessibility < 1.1 - Unauthenticated Inclusion of Functionality from Untrusted Control Sphere via Page Reader
- ID
- WPSEC-2026-0799
- Plugin
- Real Accessibility (real-accessability)
- Affected
- all versions before 1.1
- Remediation
- Update to 1.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-829
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-12
- Attack surface
- Real Accessibility on WPSec AttackSurface
- Fix released
- Published
Description
The Real Accessibility plugin for WordPress is vulnerable to Inclusion of Functionality from Untrusted Control Sphere in versions prior to 1.1. This is because the plugin's page reader loads a script from the external 508fi.org domain into the site's pages when a visitor starts reading, and that domain is no longer operated by the original service. This makes it possible for whoever controls that domain, without any access to the site, to run arbitrary JavaScript in the browsers of visitors who use the page reader, including logged-in administrators, which could be used to perform actions on their behalf.
References
- https://wpsec.com/vuln/WPSEC-2026-0799/
- https://plugins.svn.wordpress.org/real-accessability/tags/1.1/
- https://wordpress.org/plugins/real-accessability/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS