The Pz‑LinkCard plugin for WordPress allows authenticated users with Contributor-level access or higher to store malicious scripts in the 'blogcard' shortcode attributes. Because the plugin fails to properly sanitise or escape these attributes before rendering, the injected scripts are persisted in the database and executed automatically whenever a user loads a page that contains the shortcode, leading to cross‑site scripting that can compromise user sessions or deface content. This weakness aligns with CWE‑79.

WordPress sites that have installed the Pz‑LinkCard plugin, poporon:Pz‑LinkCard, in any version up to and including 2.5.8.1. The vulnerability exists in all releases prior to that version and affects any site that deploys the shortcode. Exact affected releases include all WordPress installations using 2.5.8.1 or earlier.

The CVSS score of 6.4 indicates a moderate risk level. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. Attackers must be authenticated with Contributor or higher privileges, so public exploitation requires initial compromise or an existing account. Nonetheless, the stored nature of the flaw means that once an attacker injects code, it will continue to affect every visitor to the affected page until the content is removed or the plugin is updated. Therefore, sites using the vulnerable version should treat this as a priority fix.