CVE-2026-15652 shapedplugin CVE debrief

Who should care

Users of the Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ plugin for WordPress, especially those with contributor-level access and above, should be aware of this vulnerability. The vulnerability allows authenticated attackers to inject arbitrary web scripts, potentially leading to unauthorized actions or data breaches. Operators of WordPress sites using the Easy Accordion plugin should prioritize updating the plugin and restricting access to trusted users. Vulnerability management and security teams should review the official advisory and CVE record to validate affected scope and severity.

Technical summary

The vulnerability exists in the Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ plugin for WordPress, specifically in the 'align' Block Attribute. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages, which will execute when a user accesses an injected page. The vulnerability is caused by insufficient input sanitization and output escaping. The CVSS score of 6.4 indicates a MEDIUM severity vulnerability. The affected product is the Easy Accordion plugin, and the vulnerability affects all versions up to, and including, 3.1.6. Defenders should focus on updating the plugin to a version beyond 3.1.6 and restricting contributor-level access to trusted users.

Defensive priority

Medium priority due to the CVSS score of 6.4 and the potential for authenticated attackers to inject malicious scripts.

Recommended defensive actions

• Update the Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ plugin to a version beyond 3.1.6.
• Restrict contributor-level access and above to trusted users only.
• Monitor for suspicious activity on the WordPress site, especially for injected scripts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was published on 2026-07-16T04:17:25.463Z and has not been modified since then. The NVD entry is currently 6.4, MEDIUM severity. The Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'align' Block Attribute in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages, which will execute when a user accesses an injected page. The source of this information is limited, and defenders should verify the affected scope and severity with the vendor. The CVE record and NVD entry provide the primary evidence for this debrief.

Official resources