CVE-2022-45082: WordPress Accordions plugin <= 2.0.3 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-11-18 · updated 2026-06-17
Weakness: CWE-79

Description

Multiple Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabilities in Accordions plugin <= 2.0.3 on WordPress via &addons-style-name and &accordions_or_faqs_license_key.

Affected products

Biplob Adhikari Accordions – Multiple Accordions or FAQs Builder (WordPress plugin): before 2.1.0 — fixed in 2.1.0

How to fix

Upgrade to a fixed version: Biplob Adhikari Accordions – Multiple Accordions or FAQs Builder (WordPress plugin) 2.1.0. Check the vendor advisory for mitigations.

References

https://patchstack.com/database/vulnerability/accordions-or-faqs/wordpress-accordions-plugin-2-0-3-multiple-auth-stored-cross-site-scripting-xss-vulnerabilities?_s_id=cve
https://wordpress.org/plugins/accordions-or-faqs/#developers
https://patchstack.com/database/vulnerability/accordions-or-faqs/wordpress-accordions-plugin-2-0-3-multiple-auth-stored-cross-site-scripting-xss-vulnerabilities?_s_id=cve
https://wordpress.org/plugins/accordions-or-faqs/#developers

Get alerted when CVE-2022-45082 or the next vulnerability affects your stack