CVE-2026-3643

🗓️ 15 Apr 2026 08:28:17Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 21 Views🌐 WEB

Unauthenticated stored cross-site scripting in Accessibly up to version 3.0.3 enabling widget source injection.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-3643	15 Apr 202608:28	–	attackerkb
Circl	CVE-2026-3643	22 Apr 202621:20	–	circl
CNNVD	WordPress plugin Accessibly 安全漏洞	15 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-3643 Accessibly <= 3.0.3 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Widget Source Injection via REST API	15 Apr 202608:28	–	cvelist
EUVD	EUVD-2026-22860	22 Apr 202621:31	–	euvd
NVD	CVE-2026-3643	15 Apr 202609:16	–	nvd
Patchstack	WordPress Accessibly plugin <= 3.0.3 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Widget Source Injection via REST API vulnerability	15 Apr 202613:19	–	patchstack
Positive Technologies	PT-2026-33020	15 Apr 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-3643	5 Jun 202619:21	–	redhatcve
Vulnrichment	CVE-2026-3643 Accessibly <= 3.0.3 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Widget Source Injection via REST API	15 Apr 202608:28	–	vulnrichment

Vulners

Node

onthemapmarketing accessibly_wordpress_website_accessibilityRange≤3.0.3wordpress

[
  {
    "vendor": "onthemapmarketing",
    "product": "Accessibly – WordPress Website Accessibility",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.0.3",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/otm-accessibly/tags/3.0.3/public/Data/AccessiblyOptions.php
plugins	www.plugins.trac.wordpress.org/browser/otm-accessibly/trunk/public/AssetsManager.php
plugins	www.plugins.trac.wordpress.org/browser/otm-accessibly/tags/3.0.3/public/admin/AdminApi.php
plugins	www.plugins.trac.wordpress.org/browser/otm-accessibly/trunk/public/Api/BaseApiController.php
plugins	www.plugins.trac.wordpress.org/browser/otm-accessibly/tags/3.0.3/public/Api/BaseApiController.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/f8234ea2-ff80-425f-b83d-29c422b40c6a
plugins	www.plugins.trac.wordpress.org/browser/otm-accessibly/trunk/public/Data/AccessiblyOptions.php
plugins	www.plugins.trac.wordpress.org/browser/otm-accessibly/tags/3.0.3/public/AssetsManager.php
plugins	www.plugins.trac.wordpress.org/browser/otm-accessibly/trunk/public/admin/AdminApi.php

Parameter	Position	Path	Description	CWE
widgetSrc	request body	otm-ac/v1/update-widget-options	Stored XSS via unauthenticated REST endpoint: unsanitized JSON passed to updateWidgetOptions is saved to options and later rendered as a script tag on all pages.	CWE-79
widgetSrc	request body	otm-ac/v1/update-app-config	Stored XSS via REST path that accepts JSON data and saves to options; unvalidated input can lead to widgetSrc being used as script URL on front-end.	CWE-79

17 Jun 2026 10:43Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.17.2

EPSS0.00411

SSVC

CWE-79