The vulnerability stems from improper neutralization of input during web page generation, allowing attackers to store malicious scripts in the WordPress WP Plugin Info Card data. Once injected, the script is served to any visitor of the site, enabling session hijacking, defacement, or theft of sensitive information. This flaw aligns with the Common Weakness Enumeration CWE‑79, a web application script injection weakness.

MediaRon LLC’s WP Plugin Info Card, affecting all WordPress sites that have the plugin installed in versions up to and including 6.3.5. The plugin is commonly used to display informational cards, and the flaw occurs when generating the plugin’s HTML output from stored data.

The disclosed CVSS score of 6.5 indicates a moderate severity. EPSS data is not available and the vulnerability is not currently listed in CISA’s KEV catalog. The most likely attack vector is through the plugin’s data entry interface, which typically requires authenticated access, often at an administrator level. An attacker who can create or edit card records can inject script payloads that will execute when site visitors view the card, leading to client‑side compromise. No public exploitation reports were mentioned, but the stored nature of the flaw means any defect can affect all users who view the compromised content.