CVE-2026-15652 is a stored cross-site scripting vulnerability in the Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ WordPress plugin by shapedplugin. The flaw exists in the handling of the 'align' block attribute, where input is not properly sanitized or escaped before being rendered in web pages. This allows authenticated users with contributor or higher privileges to inject arbitrary JavaScript code that executes in the context of users viewing the compromised pages. The vulnerability affects all versions up to and including 3.1.6. The CVSS 3.1 base score is 6.4, indicating a medium severity level. No official patch or remediation guidance is currently provided by the vendor.

An attacker with contributor-level or higher access can inject malicious scripts into pages via the vulnerable 'align' attribute. These scripts execute in the browsers of users who view the infected pages, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability does not require user interaction beyond viewing the page and does not affect availability. Confidentiality and integrity impacts are limited to the scope of the injected script's capabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the affected plugin if possible. Monitor for updates from shapedplugin regarding patches or official mitigations.