Back to Database
Status published
Medium
CVE-2020-13644
An issue was discovered in the Accordion plugin before 2.2.9...
Vulnerability Description
An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action allowed any authenticated user with Subscriber or higher permissions the ability to import a new accordion and inject malicious JavaScript as part of the accordion.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-13644
Credits & Attribution
No credits recorded in the NVD database.
References
More from pickplugins
View All →CVE-2025-12374
Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification <= 2.0.44 - Authentication Bypass to Account Takeover
Critical
9.8
CVE-2024-9636
Post Grid and Gutenberg Blocks 2.2.85 - 2.3.3 - Unauthenticated Privilege Escalation
Critical
9.8
CVE-2024-9111
Product Designer <= 1.0.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Medium
6.4
CVE-2024-8253
Post Grid and Gutenberg Blocks 2.2.87 - 2.2.90 - Authenticated (Subscriber+) Privilege Escalation
High
8.8
CVE-2024-7588
Gutenberg Blocks, Page Builder – ComboBlocks <= 2.2.87 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Block
Medium
6.4
Affected Vendor
pickplugins
View all reports →Affected Software
accordion
Vulnerable Versions:
0
Timeline
Official Publish:
May 28th, 2020
Last Modified:
August 4th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.0/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:C/UI:R
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.