CVE-2023-5164 in Bellows Accordion Menu Plugin
Summary
by MITRE • 10/30/2023
The Bellows Accordion Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/11/2026
The Bellows Accordion Menu plugin for WordPress presents a critical security vulnerability classified as CVE-2023-5164, affecting versions up to and including 1.4.2. This vulnerability manifests as a stored cross-site scripting flaw that specifically targets the plugin's shortcode functionality, creating a persistent threat vector within WordPress environments. The issue arises from inadequate input sanitization measures and insufficient output escaping mechanisms that fail to properly validate or escape user-supplied attributes before processing them within the plugin's shortcode implementation. Attackers exploiting this vulnerability can manipulate the plugin's behavior by injecting malicious code through carefully crafted shortcode parameters that are then stored within the WordPress database and executed whenever affected pages are accessed by unsuspecting users.
The technical exploitation of this vulnerability requires an attacker to possess at least contributor-level permissions within the WordPress environment, which represents a significant concern as contributors typically have the ability to create and edit posts, pages, and media files. This permission level is commonly granted to users who contribute content to websites, making the attack surface more accessible than vulnerabilities requiring administrator privileges. The flaw operates by allowing malicious input to be processed through the plugin's shortcode parsing mechanism without proper sanitization, enabling attackers to inject JavaScript code or other malicious scripts that will execute in the context of any user who views pages containing the compromised shortcode. The stored nature of this XSS vulnerability means that the injected scripts persist in the database and will execute every time the affected page is loaded, creating a continuous threat vector.
The operational impact of this vulnerability extends beyond simple script execution, as it can enable attackers to perform various malicious activities including session hijacking, credential theft, data exfiltration, and privilege escalation within the WordPress environment. When authenticated users access pages containing the injected malicious code, the scripts execute in their browser context with the privileges of the logged-in user, potentially allowing attackers to access sensitive content, modify website data, or even gain full administrative control if users have elevated permissions. The vulnerability affects all users who view pages containing compromised shortcodes, making it particularly dangerous in collaborative environments where multiple contributors may be working on content. This stored XSS vulnerability represents a significant risk to website integrity and user security, as the malicious code can remain dormant until triggered by user interaction with affected content.
Mitigation strategies for CVE-2023-5164 should prioritize immediate plugin updates to versions that address the sanitization and escaping deficiencies in the shortcode processing. Administrators should implement strict user permission controls to limit contributor-level access to only essential functions and consider implementing additional security measures such as content security policies to reduce the impact of potential XSS attacks. The vulnerability aligns with CWE-79, which categorizes cross-site scripting flaws as one of the most common and dangerous web application security vulnerabilities, and it maps to ATT&CK technique T1566.001 for initial access through malicious content. Organizations should also conduct thorough security audits of their WordPress installations to identify other potentially vulnerable plugins and ensure proper input validation and output escaping mechanisms are implemented across all user-supplied content processing functions. Regular security monitoring and vulnerability scanning should be maintained to detect similar issues in other plugins and themes that may present similar sanitization weaknesses.