The Business Card Block plugin version 1.0.5 and earlier contains a stored cross‑site scripting flaw that allows attackers to inject malicious JavaScript into the plugin’s stored content. The injected code is rendered when another user views the content, enabling session hijacking, data theft, or defacement. This weakness is classified as CWE‑79.

Any WordPress installation that has the bPlugins Business Card Block plugin installed in a version up to and including 1.0.5 is affected. No specific operating system or PHP version prerequisites are indicated.

The vulnerability is rated medium with a CVSS score of 6.5. The EPSS score is below 1 %, suggesting a low likelihood of active exploitation, and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that attacks likely exploit the flaw by submitting malicious content through the plugin’s input interface, either via authenticated or unauthenticated access depending on how the site is configured. No official patch or workaround is noted in the source data.