CVE-2020-13644: pickplugins accordion Cross-site Scripting
Vulnerability summary
CVE-2020-13644 is a medium (CVSS 6.4) Cross-site Scripting vulnerability in pickplugins accordion. EPSS estimates a 0.77% chance of exploitation in the next 30 days, higher than 54.9% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 2.2.9.
Timeline
- 28-05-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action allowed any authenticated user with Subscriber or higher permissions the ability to import a new accordion and inject malicious JavaScript as part of the accordion.
CVSS metrics
5 scores · 3 sources · 3 versions- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
- NVDNIST5.4MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.77%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.77% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (wordfence.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Pickplugins1 product
- accordion< 2.2.9
Wordpress1 product
- accordions< 2.2.9
2 vendors · 2 products
References
3 links- www.wordfence.com/blog/2020/04/vulnerability-patched-in-accordion-plugin/X Refsource MISCExploitThird Party Advisory