CVE-2026-18988 is a stored cross-site scripting vulnerability in the Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ WordPress plugin, affecting versions up to 3.1.8. The vulnerability stems from insufficient input sanitization and output escaping in the accordion_header_renderer() function, which improperly uses esc_attr() instead of tag_escape() for the 'accordionTitleTag' block attribute. Authenticated attackers with contributor-level privileges or higher can inject arbitrary scripts that execute when users view the compromised pages.

An attacker with contributor-level access or higher can inject malicious scripts into pages via the vulnerable attribute, leading to cross-site scripting attacks. This can result in the execution of arbitrary scripts in the context of users visiting the affected pages, potentially compromising user data or session integrity. The CVSS score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.

No official patch or fix is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or replacing the plugin if possible to mitigate risk.