joedolson — Vulnerabilities & Security Advisories 6

Joedolson develops WordPress accessibility plugins, primarily serving website owners needing compliance solutions. Historically, vulnerabilities have included stored cross-site scripting (XSS), arbitrary file inclusion, and insufficient input validation leading to remote code execution. Notable incidents include CVE-2021-24732, which allowed unauthenticated attackers to execute arbitrary PHP code via crafted requests, and CVE-2021-24733, enabling privilege escalation through improper capability checks. These vulnerabilities often stem from inadequate sanitization of user-supplied data and improper implementation of WordPress security mechanisms. The plugin's core functionality frequently interacts with sensitive WordPress functions, increasing potential attack surface when security controls are misconfigured or bypassed.