CVE-2026-2362

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2362", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-11T18:02:23.893Z", "datePublished": "2026-02-27T08:24:19.792Z", "dateUpdated": "2026-04-08T17:15:56.637Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:15:56.637Z"}, "affected": [{"vendor": "joedolson", "product": "WP Accessibility", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.3.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Accessibility plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'alt' attribute of images processed by the \"Long Description UI\" feature in all versions up to, and including, 2.3.1. This is due to the plugin's JavaScript retrieving the alt attribute using getAttribute() and unsafely concatenating it into innerHTML and insertAdjacentHTML calls without proper sanitization or escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the \"Long Description UI\" setting to be enabled and set to \"Link to description.\""}], "title": "WP Accessibility <= 2.3.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'alt' Attribute", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b08284ad-717f-4bdb-8eaa-f44e9447ff25?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-accessibility/trunk/js/wp-accessibility.js#L713"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-accessibility/trunk/js/wp-accessibility.js#L807"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-accessibility/tags/2.3.1/js/wp-accessibility.js#L713"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-accessibility/tags/2.3.1/js/wp-accessibility.js#L807"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3464593%40wp-accessibility%2Ftrunk&old=3446333%40wp-accessibility%2Ftrunk&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Qu\u1ed1c Huy"}], "timeline": [{"time": "2026-02-11T19:25:20.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-26T19:26:02.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-27T16:38:20.481048Z", "id": "CVE-2026-2362", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T18:45:14.718Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2362", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-27T16:38:20.481048Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T18:45:10.303Z"}}], "cna": {"title": "WP Accessibility <= 2.3.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'alt' Attribute", "credits": [{"lang": "en", "type": "finder", "value": "Qu\u1ed1c Huy"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "joedolson", "product": "WP Accessibility", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.3.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-11T19:25:20.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-26T19:26:02.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b08284ad-717f-4bdb-8eaa-f44e9447ff25?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-accessibility/trunk/js/wp-accessibility.js#L713"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-accessibility/trunk/js/wp-accessibility.js#L807"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-accessibility/tags/2.3.1/js/wp-accessibility.js#L713"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-accessibility/tags/2.3.1/js/wp-accessibility.js#L807"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3464593%40wp-accessibility%2Ftrunk&old=3446333%40wp-accessibility%2Ftrunk&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The WP Accessibility plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'alt' attribute of images processed by the \"Long Description UI\" feature in all versions up to, and including, 2.3.1. This is due to the plugin's JavaScript retrieving the alt attribute using getAttribute() and unsafely concatenating it into innerHTML and insertAdjacentHTML calls without proper sanitization or escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the \"Long Description UI\" setting to be enabled and set to \"Link to description.\""}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:15:56.637Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2362", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:15:56.637Z", "dateReserved": "2026-02-11T18:02:23.893Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-27T08:24:19.792Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Accessibility", "vendor": "joedolson", "versions": [{"lessThanOrEqual": "2.3.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Accessibility plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'alt' attribute of images processed by the \"Long Description UI\" feature in all versions up to, and including, 2.3.1. This is due to the plugin's JavaScript retrieving the alt attribute using getAttribute() and unsafely concatenating it into innerHTML and insertAdjacentHTML calls without proper sanitization or escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the \"Long Description UI\" setting to be enabled and set to \"Link to description.\""}, {"lang": "es", "value": "El plugin WP Accessibility para WordPress es vulnerable a cross-site scripting persistente basado en DOM a trav\u00e9s del atributo 'alt' de las im\u00e1genes procesadas por la funci\u00f3n \"Long Description UI\" en todas las versiones hasta la 2.3.1, inclusive. Esto se debe a que el JavaScript del plugin recupera el atributo alt usando getAttribute() y lo concatena de forma insegura en llamadas a innerHTML e insertAdjacentHTML sin una sanitizaci\u00f3n o escape adecuados. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador o superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada. La explotaci\u00f3n requiere que la configuraci\u00f3n \"Long Description UI\" est\u00e9 habilitada y establecida en \"Link a description.\""}], "id": "CVE-2026-2362", "lastModified": "2026-06-17T10:30:50.540", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2362", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-27T16:38:20.481048Z", "version": "2.0.3"}}]}, "published": "2026-02-27T09:16:17.290", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-accessibility/tags/2.3.1/js/wp-accessibility.js#L713"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-accessibility/tags/2.3.1/js/wp-accessibility.js#L807"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-accessibility/trunk/js/wp-accessibility.js#L713"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-accessibility/trunk/js/wp-accessibility.js#L807"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3464593%40wp-accessibility%2Ftrunk&old=3446333%40wp-accessibility%2Ftrunk&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b08284ad-717f-4bdb-8eaa-f44e9447ff25?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.3.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "WP Accessibility", "source": "cna", "vendor": "joedolson"}, "product": "wp_accessibility", "vendor": "joedolson"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T23:51:09.132580+00:00", "value": {"mitigation_remediation": ["Update the WP Accessibility plugin to the latest available version.", "If postponed upgrade is necessary, disable the Long Description UI feature or change its mode to one that does not render alt attributes into HTML, preventing the script from reaching front\u2011end users.", "Manually review and sanitize existing image alt text for injected scripting; remove or escape any suspicious content before publishing new or existing content."], "summary": {"action": "Immediate Patch", "impact": "Stored DOM\u2011Based Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "WordPress installations running any version of the WP Accessibility plugin 2.3.1 or earlier from the vendor Joedolson are affected. The flaw exists in all builds that include the Long Description UI feature and is activated when the setting is set to \"Link to description.\" Users with Contributor or higher roles can create an exploit, while other roles cannot modify the alt text and are therefore excluded.", "description_and_impact": "The WP Accessibility plugin processes image alt text using JavaScript that reads the alt attribute with getAttribute() and then injects it directly into innerHTML or insertAdjacentHTML without sanitization, creating a DOM\u2011based cross\u2011site scripting flaw. If the Long Description UI is enabled and set to \"Link to description\", an attacker with Contributor-level privileges can store malicious script code in the alt field of any image. When a user visits a page that displays the compromised image, the script runs in the visitor\u2019s browser, allowing the attacker to execute arbitrary JavaScript on that page.", "risk_and_exploitability": "The vulnerability is scored at CVSS 6.4, indicating medium severity, and its exploit probability is very low with an EPSS of less than 1%. The flaw is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with at least Contributor access, the Long Description UI setting enabled and set to \"Link to description\", and the ability to store a malicious alt attribute value. When a site visitor accesses a page that displays the compromised image, the injected script runs in the visitor\u2019s browser, enabling the attacker to execute arbitrary JavaScript in that context. The impact is limited to the victim\u2019s browser session and does not directly affect the server or other users beyond the page rendering."}}}}, "created": "2026-02-27T16:06:00.507920+00:00", "updated": "2026-04-16T00:00:14.136015+00:00", "vendors": ["joedolson", "joedolson$PRODUCT$wp_accessibility", "wordpress", "wordpress$PRODUCT$wordpress"]}