Vulnerability DatabaseCVE-2025-26981

CVE-2025-26981:
WordPress vulnerability analysis and mitigation

Overview

A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the Web Accessibility By accessiBe WordPress plugin, affecting versions up to 2.5. The vulnerability was reported on February 3, 2025, and publicly disclosed on February 23, 2025. This security issue allows unauthenticated attackers to perform cross-site scripting attacks (Patchstack).

Technical details

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It has been assigned a CVSS v3.1 Base Score of 7.1 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vulnerability requires no authentication to exploit and involves user interaction (NVD, Patchstack).

Impact

This vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when visitors access the affected site, potentially compromising user security and website integrity (Patchstack).

Mitigation and workarounds

The vulnerability has been fixed in version 2.6 of the Web Accessibility By accessiBe plugin. Users are advised to update to version 2.6 or later immediately. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).