The Info Cards plugin for WordPress contains a stored cross‑site scripting flaw that fails to neutralize user input before rendering it in web pages. Attackers can inject malicious JavaScript that executes in the browsers of any visitor rendering the affected card, potentially stealing session data or defacing content. The issue is identified as a CWE‑79 vulnerability and can compromise confidentiality and integrity of user data on the affected site.

The vulnerability affects the bPlugins:Info Cards plugin for WordPress versions from the earliest available release up to and including 1.0.5. Site administrators who have installed any of these versions on a WordPress installation are at risk.

The CVSS base score is 6.5, indicating a moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation, and the flaw is not currently listed in the CISA KEV catalog. The likely attack vector is through the plugin’s input forms or card creation interface, where an attacker with write privileges can inject malicious payloads that are later stored and displayed to all users.