The kk blog card plugin for WordPress contains stored cross-site scripting vulnerabilities in its 'blog-card' shortcode. Shortcode attributes 'href' and 'type' are concatenated directly into HTML without sufficient sanitisation or escaping, allowing an authenticated contributor or higher-privilege user to inject arbitrary JavaScript that is then stored and rendered whenever the injected page is accessed.

The vulnerability exists in all versions of the kk blog card plugin up to and including 1.3. It affects WordPress sites that have installed this plugin, regardless of the WordPress core version, and requires at least contributor-level permissions to create or edit content that contains the shortcode.

With a CVSS score of 6.4, the flaw is considered moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Attackers must be authenticated and possess contributor or higher privileges; once compromised, they can inject scripts that will execute in the browsers of all users who view the affected page. The fact that the injection is stored increases the persistence and potential impact, making the risk high if the site’s user base is significant.