WP Accessibility < 1.7.0 – Minor Authenticated Stored XSS in custom CSS | Plugin Vulnerabilities

Description

A minor authenticated stored XSS vulnerability was found in the "Styles for Skiplinks when they have focus" section of the WP Accessibility plugin.

Proof of Concept

1) Navigate to the Settings page of the plugin

https://example.com/wp-admin/options-general.php?page=wp-accessibility/wp-accessibility.php

2) Select the checkbox next to "Enable Skiplinks"

3) Under the "Styles for Skiplinks when they have focus" option, enter the following XSS payload:

</style><script>alert(/0/)</script>

4) Navigate to the WordPress homepage and you'll see an XSS popup

Affects Plugins

wp-accessibility

Fixed in 1.7.0

References

URL

https://plugins.trac.wordpress.org/changeset/2218372

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

Miscellaneous

Submitter

Ananda Krishna

Submitter website

https://www.getastra.com/

Submitter twitter

https://twitter.com/getastra

Verified

No

WPVDB ID

beebae8f-fa48-46c9-9e57-ce724850201c

Timeline

Publicly Published

2019-12-26 (about 6 years ago)

Added

2020-01-21 (about 6 years ago)

Last Updated

2020-01-21 (about 6 years ago)

Other

Published

Title

Published

2024-04-24

Title

month name translation benaceur < 2.3.8 - Admin+ Stored XSS

Published

2026-01-09

Title

Web Accessibility with Max Access <= 2.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2025-12-13

Title

Addon Elements for Elementor < 1.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2015-04-25

Title

The7 Premium Theme < 2.1.1 - Cross-Site Scripting (XSS)

Published

2026-01-26

Title

Email Inquiry & Cart Options for WooCommerce <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting