# Accordion Toggle <= 1.3.1 - Authenticated (Contributor+) CSS Injection via Block Style Attributes

- **ID:** WPSEC-2026-3036
- **Plugin:** Accordion Toggle (`accordion-toggle`), https://wordpress.org/plugins/accordion-toggle/
- **Affected versions:** from 1.2.1 before 1.3.2
- **Fixed in:** 1.3.2 (Update to 1.3.2 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-74
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/accordion-toggle
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3036/

## Description

The Accordion Toggle plugin for WordPress is vulnerable to CSS Injection via block style attributes (blockMeta, commonStyles, customCss) in all versions up to, and including, 1.3.1. This is due to insufficient sanitization of block CSS before it is written to the post's public stylesheet. Versions before 1.3.1 do not sanitize this CSS at all. In 1.3.1 the sanitizer can be bypassed with CSS comments, non-hex CSS escapes in function names and unclosed url() values. This makes it possible for authenticated attackers with contributor-level access and above who lack the unfiltered_html capability to inject arbitrary CSS into the stylesheet served for a page. That CSS can load off-site resources and use attribute selectors to leak page data from users who view the page.

## References

- https://wpsec.com/vuln/WPSEC-2026-3036/
- https://plugins.svn.wordpress.org/accordion-toggle/tags/1.3.2/
- https://wordpress.org/plugins/accordion-toggle/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3036/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.