Accordion vulnerabilities

4 known CVE vulnerabilities in Accordion, translated and rated.

CVE-2026-116392High
Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection. This issue affects Accordion: from n/a through 2.3.25.
CVE-2026-66471Medium
Subscriber-level Cross Site Scripting (XSS) vulnerability in Accordion plugin versions up to and including 3.0.6.
CVE-2025-69350Medium
Stored XSS vulnerability in Accordion plugin (Themepoints) up to version 3.0.3. Improper input neutralization during web page generation allows persistent injection of malicious scripts.
CVE-2025-53421Medium
The Accordion plugin from PickPlugins has a missing authorization vulnerability, allowing exploitation of incorrect access control security levels. Affects versions up to 2.3.14.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS