CVE-2026-10862 is a stored cross-site scripting vulnerability (CWE-79) in the Accordions WordPress plugin by pickplugins. It affects all versions up to and including 2.3.23. The flaw allows authenticated users with Custom-level privileges or above to inject arbitrary web scripts via the Accordion body field. These scripts execute in the context of users visiting the injected pages due to improper neutralization of input during web page generation. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity.

An attacker with authenticated Custom-level access or higher can store malicious scripts in the Accordion body field. These scripts execute in the browsers of users who view the affected pages, potentially leading to session hijacking, defacement, or other actions permitted by the victim's privileges. The vulnerability does not impact availability. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Custom-level access and above to trusted users only to reduce risk. Monitor for updates from pickplugins regarding a security patch or official fix for this vulnerability.