Information disclosure in Accessibewp Web Accessibility By Accessibe
CVE-2025-13113
The Web Accessibility by accessiBe plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.11. This is due to the `accessibe_render_js_in_footer()` function logging the complete plugin options array to the browser console on public pages, without restricting output to privileged users or checking for debug mode. This makes it possible for unauthenticated attackers to view sensitive configuration data, including email addresses, accessiBe user IDs, account IDs, and license information, via the browser console when the widget is disabled.
Vulnerability class: Information Disclosure
EPSS: 0.003 (20.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Accessibewp Web Accessibility By Accessibe — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-13113?
- CVE-2025-13113 is a medium-severity vulnerability in Accessibewp Web Accessibility By Accessibe, classified under Information Disclosure. CVSS score: 5.3/10. Published 2026-02-19.
- How severe is CVE-2025-13113?
- Medium severity. CVSS v3 base score is 5.3 out of 10.