WordPress plugin

Accessibility Suite by Ability, Inc security & vulnerabilities

Q: Does Accessibility Suite by Ability, Inc have known vulnerabilities?

Yes. VulnCrest Radar lists 8 known vulnerabilities in Accessibility Suite by Ability, Inc: 4 high, 4 medium. At least one is not fixed in the latest version.

Q: How do I check which version of Accessibility Suite by Ability, Inc I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

Q: What is the most recent Accessibility Suite by Ability, Inc vulnerability?

CVE-2026-3773, published Apr 15, 2026: Accessibility Suite by Ability, Inc <= 4.20 - Authenticated (Subscriber+) SQL Injection via 'scan_id' Parameter. Severity: Medium (CVSS 6.5).

Q: Is any Accessibility Suite by Ability, Inc vulnerability listed in CISA KEV?

No. None of the known Accessibility Suite by Ability, Inc vulnerabilities is currently listed in the CISA KEV catalog.

online-accessibility— active installsLast vulnerability Apr 15, 2026

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin

8Known vulnerabilities

Critical0
High4
Medium4
Low0

Vulnerabilities per year

All Accessibility Suite by Ability, Inc vulnerabilities

Accessibility Suite by Ability, Inc vulnerabilities
Severity	Vulnerability	CVE	Published
High8.8	Authenticated (Subscriber+) Arbitrary File Upload ≤4.18Update to 4.19	CVE-2025-32215	Apr 7, 2025
High8.8	Authenticated (Subscriber+) SQL Injection ≤4.12Update to 4.13	CVE-2023-45830	Oct 13, 2023
High8.8	Authenticated (Subscriber+) SQL Injection ≤4.11Update to 4.12	CVE-2022-47420	Apr 19, 2023
High8.8	SQL Injection <2.0.11Update to 2.0.11	—	Feb 13, 2019

High8.8
Authenticated (Subscriber+) Arbitrary File Upload
≤4.18Update to 4.19
CVE-2025-32215Apr 7, 2025
High8.8
Authenticated (Subscriber+) SQL Injection
≤4.12Update to 4.13
CVE-2023-45830Oct 13, 2023
High8.8
Authenticated (Subscriber+) SQL Injection
≤4.11Update to 4.12
CVE-2022-47420Apr 19, 2023
High8.8
SQL Injection
<2.0.11Update to 2.0.11
c6b395b1-c6fb-4ab9-b446-cba9e32ca65dFeb 13, 2019

Accessibility Suite by Ability, Inc: common questions

Does Accessibility Suite by Ability, Inc have known vulnerabilities?

Yes. VulnCrest Radar lists 8 known vulnerabilities in Accessibility Suite by Ability, Inc: 4 high, 4 medium. At least one is not fixed in the latest version.

How do I check which version of Accessibility Suite by Ability, Inc I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Accessibility Suite by Ability, Inc vulnerability?

CVE-2026-3773, published Apr 15, 2026: Accessibility Suite by Ability, Inc <= 4.20 - Authenticated (Subscriber+) SQL Injection via 'scan_id' Parameter. Severity: Medium (CVSS 6.5).

Is any Accessibility Suite by Ability, Inc vulnerability listed in CISA KEV?

No. None of the known Accessibility Suite by Ability, Inc vulnerabilities is currently listed in the CISA KEV catalog.