# Real Accessibility < 1.1 - Unauthenticated Inclusion of Functionality from Untrusted Control Sphere via Page Reader

- **ID:** WPSEC-2026-0799
- **Plugin:** Real Accessibility (`real-accessability`), https://wordpress.org/plugins/real-accessability/
- **Affected versions:** all versions before 1.1
- **Fixed in:** 1.1 (Update to 1.1 or later.)
- **Severity:** Medium 4.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-829
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/real-accessability
- **Fix released:** 2026-10-10
- **Published:** 2026-10-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0799/

## Description

The Real Accessibility plugin for WordPress is vulnerable to Inclusion of Functionality from Untrusted Control Sphere in versions prior to 1.1. This is because the plugin's page reader loads a script from the external 508fi.org domain into the site's pages when a visitor starts reading, and that domain is no longer operated by the original service. This makes it possible for whoever controls that domain, without any access to the site, to run arbitrary JavaScript in the browsers of visitors who use the page reader, including logged-in administrators, which could be used to perform actions on their behalf.

## References

- https://wpsec.com/vuln/WPSEC-2026-0799/
- https://plugins.svn.wordpress.org/real-accessability/tags/1.1/
- https://wordpress.org/plugins/real-accessability/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0799/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.