Accordions

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Accordions

Information

Software Type Plugin
Software Slug accordions (view on wordpress.org)
Software Status Active
Software Author pickplugins
Software Website pickplugins.com
Software Downloads 1,353,086
Software Active Installs 20,000
Software Record Last Updated July 16, 2026

9 Vulnerabilities

Submit a Vulnerability
Accordions <= 2.3.23 - Authenticated (Custom+) Stored Cross-Site Scripting via Accordion Body Field
6.4
CVE-2026-10862
Jun 8, 2026
Researcher: Osvaldo Noe Gonzalez Del Rio (Os)
Accordion <= 2.3.15 - Missing Authorization
4.3
CVE-2025-58678
Sep 22, 2025
Researcher: Abu Hurayra (HurayraIIT)
Accordion <= 2.3.14 - Missing Authorization
4.3
CVE-2025-53421
Sep 16, 2025
Researcher: Abu Hurayra (HurayraIIT)
Accordion <= 2.3.11 - Authenticated (Contributor+) PHP Object Injection
8.8
CVE-2025-32143
Apr 9, 2025
Researcher: LVT-tholv2k
Accordion <= 2.2.99 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-47342
Sep 27, 2024
Researcher: Robert DeVore
Accordion <= 2.2.96 - Missing Authorization to Authenticated(Contributor+) Post Duplication
5.4
CVE-2024-1641
Mar 13, 2024
Researcher: Lucio Sá
Accordion <= 2.2.43 - Authenticated (Admin+) Stored Cross-Site Scripting
5.5
CVE ID Unknown
Aug 17, 2022
Researchers:
Accordion <= 2.2.29 - Reflected Cross-Site Scripting
6.1
CVE-2021-24283
Apr 21, 2021
Researcher: iohex
Accordion <= 2.2.8 - Unprotected AJAX Action to Stored/Reflected Cross-Site Scripting
6.4
CVE-2020-13644
Mar 18, 2020
Researcher: Chloe Chamberland
Title Status CVE ID CVSS Researchers Date
Accordions <= 2.3.23 - Authenticated (Custom+) Stored Cross-Site Scripting via Accordion Body Field Patched CVE-2026-10862 6.4 Osvaldo Noe Gonzalez Del Rio (Os) June 8, 2026
Accordion <= 2.3.15 - Missing Authorization Patched CVE-2025-58678 4.3 Abu Hurayra (HurayraIIT) September 22, 2025
Accordion <= 2.3.14 - Missing Authorization Patched CVE-2025-53421 4.3 Abu Hurayra (HurayraIIT) September 16, 2025
Accordion <= 2.3.11 - Authenticated (Contributor+) PHP Object Injection Patched CVE-2025-32143 8.8 LVT-tholv2k April 9, 2025
Accordion <= 2.2.99 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-47342 6.4 Robert DeVore September 27, 2024
Accordion <= 2.2.96 - Missing Authorization to Authenticated(Contributor+) Post Duplication Patched CVE-2024-1641 5.4 Lucio Sá March 13, 2024
Accordion <= 2.2.43 - Authenticated (Admin+) Stored Cross-Site Scripting Patched 5.5 August 17, 2022
Accordion <= 2.2.29 - Reflected Cross-Site Scripting Patched CVE-2021-24283 6.1 iohex April 21, 2021
Accordion <= 2.2.8 - Unprotected AJAX Action to Stored/Reflected Cross-Site Scripting Patched CVE-2020-13644 6.4 Chloe Chamberland March 18, 2020

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation