A critical Stored Cross-Site Scripting vulnerability in the Accessibly WordPress plugin allows unauthenticated attackers to execute arbitrary JavaScript on front-end pages, posing a severe risk to site visitors.

The plugin fails to perform capability checks on REST API endpoints, specifically /otm-ac/v1/update-widget-options. This allows unauthenticated attackers to supply malicious JSON data that is stored and subsequently rendered as a script tag on all front-end pages.

The ability for an unauthenticated attacker to inject arbitrary scripts into the front end of a website creates a high risk of site compromise. Successful exploitation could lead to session hijacking of administrators, redirection of visitors to malicious domains, or the theft of sensitive user information. With a CVSS score of 7.2, this vulnerability is classified as High, reflecting the potential for significant reputational damage and loss of user trust.

Immediate Action: As no patched version is currently confirmed, administrators should immediately deactivate and remove the Accessibly plugin until an update is provided by the vendor.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at /wp-json/otm-ac/v1/update-widget-options or similar endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized access to the plugin's specific REST API endpoints and to filter malicious script payloads.

Public Exploit Available: Unknown

The vulnerability presents a significant security risk due to the lack of required authentication. Organizations utilizing the Accessibly plugin must prioritize its removal from their environments immediately to prevent potential cross-site scripting attacks. Continue to monitor the vendor's official channels for the release of a secure version before considering re-installation.