CVE-2021-24283: Pickplugins Accordion

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue.

Affected products

• Pickplugins Accordion: before 2.2.30 (fixed in 2.2.30)

Published 2021-05-14. Last modified 2026-06-17.