CVE-2026-14481 is a stored cross-site scripting vulnerability in the Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance WordPress plugin. The issue arises from improper neutralization of input in the 'html' parameter of the REST endpoint /accessibility-checker/v1/post-scan-results/{id}. Authenticated attackers with contributor-level permissions or higher can inject arbitrary web scripts into posts, which execute when users access those posts. The vulnerability affects all versions up to and including 1.46.0. The REST endpoint is guarded by the edit_post capability, limiting exploitation to users who can edit posts. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

An attacker with contributor-level or higher privileges can inject persistent malicious scripts into WordPress posts via the vulnerable plugin. These scripts execute in the context of users viewing the affected posts, potentially leading to theft of sensitive information, session hijacking, or other client-side attacks. The vulnerability compromises confidentiality and integrity but does not affect availability. The attack requires authenticated access with post editing rights, limiting the scope to users with such permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level and higher user permissions to trusted users only. Monitor for plugin updates from equalizedigital addressing this vulnerability and apply them promptly once available. Avoid granting unnecessary post editing capabilities to reduce risk.