CVE-2026-62127: WordPress WP plugin Info Card plugin <= 6.3.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MediaRon LLC WP Plugin Info Card wp-plugin-info-card allows Stored XSS.This issue affects WP Plugin Info Card: from n/a through 6.3.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Plugin Info Cardto a version that resolves this vulnerability.Fixed in 6.4.0
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability requires low-privileged access to the WordPress site. It also requires user interaction, according to the CVSS vector.
Which installations are affected?
WP Plugin Info Card versions through 6.3.5 are affected. The available data does not identify a fixed version.
What impact could successful exploitation have?
Successful stored XSS could allow attacker-supplied script to execute in another user's browser when they view affected content. The CVSS vector indicates low confidentiality, integrity, and availability impact, with scope changed.