CVE-2025-66092: Accordion Slider Stored XSS Vulnerability

CVE-2025-66092 Overview

CVE-2025-66092 is a stored Cross-Site Scripting (XSS) vulnerability in the bqworks Accordion Slider plugin for WordPress. The flaw affects all versions up to and including 1.9.13. The plugin fails to properly neutralize user-supplied input during web page generation, allowing authenticated attackers with low privileges to inject persistent JavaScript payloads. Stored payloads execute in the browser of any user who views the affected page, enabling session theft, forced redirects, and content manipulation. The vulnerability is tracked under CWE-79 and documented in the Patchstack XSS Vulnerability Report.

Critical Impact
Authenticated attackers can inject persistent JavaScript that executes against site visitors and administrators, enabling account takeover and site defacement.

Affected Products

bqworks Accordion Slider WordPress plugin, versions up to and including 1.9.13
WordPress sites with the accordion-slider plugin installed and activated
Any user session interacting with pages that render affected slider content

Discovery Timeline

2025-11-21 - CVE-2025-66092 published to the National Vulnerability Database (NVD)
2026-10-18 - Last updated in NVD database

Technical Details for CVE-2025-66092

Vulnerability Analysis

The Accordion Slider plugin accepts input from authenticated users and stores it without sufficient sanitization or output encoding. When the stored content is later rendered into a WordPress page, injected markup is interpreted as executable HTML and JavaScript. The scope change in the CVSS vector indicates that the injected script runs in a security context different from the vulnerable component, which is typical for XSS payloads that execute against site administrators or visitors. Exploitation requires low privileges and user interaction, meaning an attacker needs an authenticated account capable of editing slider content, and a victim must load the affected page.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The plugin does not consistently apply WordPress sanitization helpers such as wp_kses_post(), sanitize_text_field(), or esc_attr() and esc_html() on output. Attacker-controlled values pass unchanged from storage to the DOM.

Attack Vector

An authenticated contributor-level or editor-level user crafts a slider entry containing an HTML payload with an event handler or <script> block. The payload is persisted in the WordPress database. When another authenticated user, including an administrator, previews or edits the slider — or when an unauthenticated visitor loads a front-end page rendering the slider — the browser executes the attacker's script.

No verified exploit code is publicly available. Refer to the Patchstack XSS Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-66092

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or event-handler attributes (onerror, onload, onmouseover) stored in wp_postmeta entries associated with the accordion-slider plugin.
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after loading a page containing an accordion slider.
New or modified WordPress administrator accounts created without a corresponding authorized change ticket.

Detection Strategies

Query the WordPress database for slider records containing HTML tags or JavaScript keywords in fields expected to hold plain text.
Enable WordPress audit logging to capture changes to slider posts, including the author, timestamp, and content diff.
Deploy a Web Application Firewall (WAF) rule to flag POST requests to the slider admin endpoints that contain <script, onerror=, or encoded equivalents.

Monitoring Recommendations

Monitor WordPress error logs and browser Content Security Policy (CSP) reports for script-src violations tied to slider pages.
Alert on anomalous administrator session activity, including privilege changes and plugin installations following slider edits.
Track plugin version inventory to confirm all Accordion Slider installations are upgraded above 1.9.13 once a patched release is available.

How to Mitigate CVE-2025-66092

Immediate Actions Required

Update the bqworks Accordion Slider plugin to a version later than 1.9.13 as soon as the vendor publishes a fix.
Review all accounts with contributor privileges or higher and remove unnecessary access to slider editing capabilities.
Audit existing slider content and remove any entries containing HTML tags, event handlers, or script references.

Patch Information

At the time of publication, the vendor advisory tracked in the Patchstack XSS Vulnerability Report indicates the vulnerability affects versions up to and including 1.9.13. Administrators should monitor the WordPress plugin repository for an updated release and apply it immediately.

Workarounds

Deactivate and remove the Accordion Slider plugin until a patched version is installed.
Restrict slider editing permissions to trusted administrators by adjusting role capabilities with a plugin such as User Role Editor.
Deploy a WAF or virtual patching rule that blocks requests containing script tags or JavaScript event handlers to the slider admin endpoints.

bash

# Example WordPress CLI commands to inventory and disable the plugin
wp plugin list --name=accordion-slider --fields=name,status,version
wp plugin deactivate accordion-slider