Is Web Accessibility - WCAG Scanning, Guided Fixes, Usability Widget safe?

Plugin details

• Slug: pojo-accessibility
• Requires PHP: 7.4+
• Max supported PHP (analyzed): 8.4

Known vulnerabilities

• Web Accessibility (formally known as Ally) &#8211; WCAG Scanning, Guided Fixes, Usability Widget [pojo-accessibility] < 3.2.0 [CVE-2025-32640, WordPress One Click Accessibility Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS), One Click Accessibility <= 3.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting, EUVD-2025-10575]
• Web Accessibility (formally known as Ally) &#8211; WCAG Scanning, Guided Fixes, Usability Widget [pojo-accessibility] < 3.8.1 [CVE-2025-10700, Ally - Web Accessibility & Usability <= 3.8.0 - Cross-Site Request Forgery to Plugin Settings Update]
• Web Accessibility (formally known as Ally) &#8211; WCAG Scanning, Guided Fixes, Usability Widget [pojo-accessibility] < 4.0.3 [CVE-2026-25386, Ally <= 4.0.2 - Missing Authorization]
• Web Accessibility (formally known as Ally) &#8211; WCAG Scanning, Guided Fixes, Usability Widget [pojo-accessibility] < 4.1.0 [CVE-2026-2413, Ally – Web Accessibility & Usability <= 4.0.3 - Unauthenticated SQL Injection via URL Path]

Vulnerabilities are matched against the exact installed version when it's known. Always keep the plugin updated to the latest release.

Safer / more established alternatives

• Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO) — 100000+ active installs — max PHP 8.4
• Accessibility by UserWay — 80000+ active installs — max PHP 8.4
• WP Accessibility — 60000+ active installs — max PHP 8.4
• AccessibleWP – Accessibility Toolbar — 20000+ active installs
• Alt Text AI – Automatically generate image alt text for SEO and accessibility — 20000+ active installs