Accordion Toggle <= 1.3.1 - Authenticated (Contributor+) CSS Injection via Block Style Attributes
- ID
- WPSEC-2026-3036
- Plugin
- Accordion Toggle (accordion-toggle)
- Affected
- from 1.2.1 before 1.3.2
- Remediation
- Update to 1.3.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-74
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-13
- Attack surface
- Accordion Toggle on WPSec AttackSurface
- Fix released
- Published
Description
The Accordion Toggle plugin for WordPress is vulnerable to CSS Injection via block style attributes (blockMeta, commonStyles, customCss) in all versions up to, and including, 1.3.1. This is due to insufficient sanitization of block CSS before it is written to the post's public stylesheet. Versions before 1.3.1 do not sanitize this CSS at all. In 1.3.1 the sanitizer can be bypassed with CSS comments, non-hex CSS escapes in function names and unclosed url() values. This makes it possible for authenticated attackers with contributor-level access and above who lack the unfiltered_html capability to inject arbitrary CSS into the stylesheet served for a page. That CSS can load off-site resources and use attribute selectors to leak page data from users who view the page.
References
- https://wpsec.com/vuln/WPSEC-2026-3036/
- https://plugins.svn.wordpress.org/accordion-toggle/tags/1.3.2/
- https://wordpress.org/plugins/accordion-toggle/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS