CVE-2026-14481: WordPress Accessibility Checker XSS Flaw

CVE-2026-14481 Overview

CVE-2026-14481 is a Stored Cross-Site Scripting (XSS) vulnerability in the Equalize Digital Accessibility Checker plugin for WordPress. The plugin markets itself as a WCAG, ADA, EAA, and Section 508 compliance solution. All versions up to and including 1.46.0 fail to properly sanitize input and escape output on the html parameter. Authenticated users holding contributor-level access or higher can inject arbitrary JavaScript that executes when other users view affected pages. The flaw is reachable through the REST endpoint /accessibility-checker/v1/post-scan-results/{id}, which enforces only the edit_post capability on the target post. The weakness is classified as CWE-79.

Critical Impact
Authenticated contributors can persist JavaScript payloads that execute in the browsers of higher-privileged users, enabling session theft, forced administrative actions, and account takeover.

Affected Products

Equalize Digital Accessibility Checker plugin for WordPress, versions up to and including 1.46.0
WordPress sites where contributor-level or higher accounts exist
WordPress deployments exposing the /accessibility-checker/v1/post-scan-results/{id} REST endpoint

Discovery Timeline

2026-07-23 - CVE-2026-14481 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-14481

Vulnerability Analysis

The vulnerability resides in how the Accessibility Checker plugin stores and later renders HTML fragments captured during accessibility scans. The html parameter received by the plugin is written to the database without adequate input sanitization. When the stored content is emitted back into administrative or public views, the plugin does not apply appropriate output escaping. As a result, script payloads injected during a scan submission are rendered as executable JavaScript in the context of the visiting user's browser.

Root Cause

The root cause is a combined failure of input sanitization and output escaping around scan-result data. WordPress provides helpers such as wp_kses_post() and esc_html() for exactly this pattern, but the affected code paths in class-ajax.php, class-insert-rule-data.php, class-rest-api.php, and helper-functions.php accept and re-emit the html value without sufficient filtering. Because the REST route relies only on the edit_post capability check against the target post, any user who can edit a post — including contributors — satisfies the authorization requirement.

Attack Vector

An authenticated attacker with contributor privileges creates or edits a post they own, then issues a request to the REST endpoint /accessibility-checker/v1/post-scan-results/{id} supplying a malicious html payload. The payload is persisted alongside the scan results. When an editor, administrator, or site visitor accesses a view that renders the stored data, the injected script executes with the victim's session context. Typical outcomes include cookie exfiltration, forced privileged actions via authenticated CSRF, and drive-by pivots to further site compromise. See the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-14481

Indicators of Compromise

POST or PUT requests to /wp-json/accessibility-checker/v1/post-scan-results/{id} originating from contributor-level accounts and containing <script>, onerror=, onload=, or javascript: substrings in the html parameter.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing posts or the plugin's scan-results interface.
Newly created WordPress administrator accounts or modified user roles following contributor activity on the plugin's endpoints.

Detection Strategies

Inspect web server and WordPress request logs for anomalous payloads submitted to the plugin's REST namespace accessibility-checker/v1/.
Query the WordPress database for scan-result records containing HTML event handler attributes or <script> tags stored by non-privileged authors.
Correlate contributor-role activity with subsequent administrator session anomalies such as new plugin installations or option changes.

Monitoring Recommendations

Enable and centralize WordPress audit logging to capture REST API calls, capability checks, and role changes.
Deploy a web application firewall rule that inspects the html parameter on the plugin's endpoint for script tags and event handlers.
Alert on any content-editor account that begins interacting with plugin REST endpoints it has not previously used.

How to Mitigate CVE-2026-14481

Immediate Actions Required

Update the Equalize Digital Accessibility Checker plugin to a version later than 1.46.0 as soon as a fixed release is available from the vendor.
Audit contributor and author accounts, removing inactive users and enforcing strong authentication on all remaining accounts.
Review posts and stored scan-result records for existing malicious HTML and purge any injected script content.

Patch Information

The vulnerability affects all versions through 1.46.0. Consult the WordPress Accessibility Checker Changeset and the Wordfence Vulnerability Report for the fixed release identifier and remediated code paths in class-ajax.php, class-insert-rule-data.php, class-rest-api.php, and helper-functions.php.

Workarounds

Temporarily deactivate the Accessibility Checker plugin until an updated version can be installed and validated.
Restrict the edit_posts capability so that only trusted, vetted accounts can author content on the site.
Deploy a WAF signature that blocks requests to /wp-json/accessibility-checker/v1/post-scan-results/ containing HTML script constructs in the html parameter.

bash

# Example WAF rule (ModSecurity) blocking script payloads on the affected endpoint
SecRule REQUEST_URI "@contains /wp-json/accessibility-checker/v1/post-scan-results/" \
    "phase:2,chain,deny,status:403,id:1026144810,\
     msg:'CVE-2026-14481 Stored XSS attempt in html parameter'"
    SecRule ARGS:html "@rx (?i)(<script|onerror\s*=|onload\s*=|javascript:)" \
        "t:none,t:urlDecodeUni"