{
 "id": "WPSEC-2026-0799",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0799/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0799/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0799/index.md",
 "title": "Real Accessibility < 1.1 - Unauthenticated Inclusion of Functionality from Untrusted Control Sphere via Page Reader",
 "description": "The Real Accessibility plugin for WordPress is vulnerable to Inclusion of Functionality from Untrusted Control Sphere in versions prior to 1.1. This is because the plugin's page reader loads a script from the external 508fi.org domain into the site's pages when a visitor starts reading, and that domain is no longer operated by the original service. This makes it possible for whoever controls that domain, without any access to the site, to run arbitrary JavaScript in the browsers of visitors who use the page reader, including logged-in administrators, which could be used to perform actions on their behalf.",
 "plugin": {
  "slug": "real-accessability",
  "name": "Real Accessibility",
  "full_name": "Real Accessibility",
  "wordpress_org": "https://wordpress.org/plugins/real-accessability/",
  "advisories_url": "https://wpsec.com/vuln/plugin/real-accessability/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/real-accessability"
 },
 "type": "UNKNOWN",
 "cwe": [
  "CWE-829"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.1",
 "remediation": "Update to 1.1 or later.",
 "fix_released": "2026-10-10T18:40:54+00:00",
 "published": "2026-10-12T11:49:14+00:00",
 "updated": "2026-10-12T11:06:55.742763+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0799/",
  "https://plugins.svn.wordpress.org/real-accessability/tags/1.1/",
  "https://wordpress.org/plugins/real-accessability/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/real-accessability",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-12"
 }
}