WP Accessibility Stored DOM-Based Cross-Site Scripting Vulnerability

A stored DOM-based cross-site scripting vulnerability has been identified in the WP Accessibility plugin for WordPress, affecting all versions through 2.3.1. The issue arises in the 'Long Description UI' feature, where the plugin's JavaScript improperly handles the 'alt' attribute of images. Authenticated attackers with Contributor-level access or higher can exploit this vulnerability to inject arbitrary scripts that execute when users view the affected page. The exploitation requires the 'Long Description UI' setting to be active and linked to the description.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the page.

Reproduction

To reproduce this vulnerability, enable the 'Long Description UI' feature in the WP Accessibility plugin settings. Upload an image without an 'alt' attribute or with invalid 'alt' text, and link it to a description. The plugin will replace the missing or invalid 'alt' text with a link to the image, which can be used to inject scripts that will be executed when the description is accessed.

Remediation

Users are advised to update the WP Accessibility plugin to version 2.3.2 or later, where this vulnerability has been patched.