CVE-2026-14481

Description

The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the -html- parameter in all versions up to, and including, 1.46.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to have the ability to edit a post, as the REST endpoint /accessibility-checker/v1/post-scan-results/{id} is guarded only by the edit_post capability on the target post.