The Info Cards – Add Text and Media in Card Layouts plugin for WordPress is vulnerable to Stored Cross‑Site Scripting. Attackers with authenticated Contributor-level or higher can inject a malicious javascript: URL into the btnUrl parameter of the block. When the block is rendered, the client‑side code inserts this value directly into an href attribute of an anchor element without protocol sanitization. As a result, legitimate users clicking the link will trigger arbitrary client‑side code in the victim’s browser, leading to potential data theft, session hijacking, or site defacement. This weakness is classified as CWE‑79.

The vulnerability affects the bplugins:Info Cards – Add Text and Media in Card Layouts WordPress plugin in all versions up to and including 2.0.7. No later version information is provided in the available data, so any instance running 2.0.7 or earlier is potentially exposed.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is not provided, and the vulnerability is not listed in CISA’s KEV catalog. Attackers must first authenticate with Contributor or higher privilege to edit the block; therefore the vector is local. Once the malicious URL is stored, it will affect all users who view the block, allowing the attacker to execute injected scripts in the context of the visible site. While the attack cannot be launched remotely without authentication, a compromised contributor account or social engineering of such an account can lead to widespread compromise within the site.