Now officially on WordPress.org

CVE Database / CVE-2025-32640

CVE · Medium

CVE-2025-32640 — Web Accessibility (formally known as Ally) – WCAG Scanning, Guided Fixes, Usability Widget [pojo-accessibility] < 3.2.0

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2025-32640 Web Accessibility (formally known as Ally) – WCAG Scanning, Guided Fixes, Usability Widget [pojo-accessibility] < 3.2.0 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Medium 5.9 < 3.2.0 3.2.0 2025-04-09 —

CVE-2025-32640

The One Click Accessibility plugin for WordPress versions 3.1.0 and earlier is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. Authenticated attackers with administrator privileges can inject malicious scripts that will run when other users view the affected pages, but this vulnerability affects only multi-site setups where unfiltered_html capabilities are restricted.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings