The WP Plugin Info Card plugin allows an authenticated user with Contributor or higher privileges to supply an arbitrary value to the containerid parameter. Because the plugin does not properly escape this input, attackers can store malicious scripts that execute whenever any user views the affected page. This stored cross‑site scripting can be leveraged to steal session cookies, deface content, or redirect users to malicious sites. The weakness is a classic unvalidated input vulnerability, identified as CWE‑79.

WordPress sites that have the WP Plugin Info Card plugin from the vendor brikou installed in any release up to and including version 5.3.1. Any host running a WordPress instance that loaded this plugin, irrespective of the host environment, is susceptible. No specific operating system or PHP version is required for exploitation; the flaw resides entirely within the plugin code.

The CVSS score of 6.4 indicates moderate severity, reflecting the need for authentication but providing a wide impact on user contexts once scripts run. The EPSS score of less than 1% signals a low probability of immediate exploitation in the wild. The flaw is not currently catalogued in CISA’s KEV, suggesting no widespread active exploitation. Attackers would need legitimate Contributor‑level credentials to inject payloads, but once in place the stored XSS acts against all visitors to the contaminated page.