PT-2026-8051 · WordPress · Simple Wp Colorfull Accordion

Dj + 1 · Publicado 2026-02-14 · Atualizado 2026-02-14 · CVE-2026-1904

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Simple Wp colorfull Accordion plugin for WordPress versions prior to 1.0

Description The Simple Wp colorfull Accordion plugin for WordPress is susceptible to Stored Cross-Site Scripting through the title parameter within the 'accordion' shortcode. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject malicious web scripts into pages. These scripts will execute whenever a user accesses the compromised page.

Recommendations Update the Simple Wp colorfull Accordion plugin to a version newer than 1.0.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-1904

Produtos afetados

Simple Wp Colorfull Accordion

Referências · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-1904 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2022581376424304902 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/simple-wp-colorfull-accordion/trunk/Simple-Wp-colorfull-Accordion.php#L60 · Nota
• https://t.me/CVEtracker/44689 · Publicação no Telegram
• https://twitter.com/CVEarity/status/2022662734710813094 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/8444743c-ba57-4a51-990c-eb9058829d09?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/simple-wp-colorfull-accordion/tags/1.0/Simple-Wp-colorfull-Accordion.php#L60 · Nota
• https://twitter.com/CVEnew/status/2022543943058030929 · Publicação no Twitter
• https://t.me/cveNotify/152021 · Publicação no Telegram