CVE-2026-116392
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection. This issue affects Accordion: from n/a through 2.3.25.
Risk Assessment
Deserialization of untrusted data may allow an attacker to inject objects and potentially perform unauthorized actions within the application.
Recommendation
Update the Accordion plugin to a version later than 2.3.25. Avoid deserializing data from untrusted sources.
Other vulnerabilities in Accordion
See all- CVE-2026-66471Medium
Subscriber-level Cross Site Scripting (XSS) vulnerability in Accordion plugin versions up to and including 3.0.6.
- CVE-2025-69350Medium
Stored XSS vulnerability in Accordion plugin (Themepoints) up to version 3.0.3. Improper input neutralization during web page generation allows persistent injection of malicious scripts.
- CVE-2025-53421Medium
The Accordion plugin from PickPlugins has a missing authorization vulnerability, allowing exploitation of incorrect access control security levels. Affects versions up to 2.3.14.
Original NVD description (English source)
Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: from n/a through 2.3.25.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS