EUVD-2026-13072Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 score of 6.4 with vector AVICN/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N reflects moderate real-world risk. The attack vector is network-based with low complexity and no user interaction required from the attacker's perspective (though the victim must click the injected link, which is implicit in the UI:N rating for the attacker's effort). The requirement for Contributor-level privileges significantly restricts the attack surface to authenticated users, but many WordPress sites operate with multiple authors, freelancers, or plugin administrators, making this a realistic threat model. The lack of KEV listing and no documented active exploitation suggest this is not yet a widespread campaign, but the straightforward nature of the exploit (simple javascript: URL injection) and the presence of vulnerable versions in active use indicate relatively high likelihood of weaponization. EPSS data is not provided in the intelligence, but the combination of easy-to-understand attack mechanics, moderate CVSS impact (confidentiality and integrity), and broad applicability to WordPress sites warrants prioritization in patching schedules. The scope change (S:C) indicating cross-site impact elevates this beyond a simple self-XSS concern. |
| Exploit ScenarioDerived | A WordPress site administrator has allowed a freelance content contributor with Contributor-level access to write blog posts using the Info Cards block for visual layout. The malicious contributor crafts an info card with a button that appears to link to a legitimate external site but sets the btnUrl parameter to javascript:alert('XSS');void(0); or a more sophisticated payload that exfiltrates cookies or redirects users to a phishing site. When site visitors click the button in published content, the injected JavaScript executes in their browsers with the privileges of the logged-in user, potentially leading to account compromise or credential theft. Because the vulnerability is stored in the block content, the attack persists until the card is manually edited or deleted. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 19, 2026
The Info Cards - Add Text and Media in Card Layouts WordPress plugin versions up to 2.0.7 contains a Stored Cross-Site Scripting vulnerability in the 'btnUrl' parameter of the Info Cards block that allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript code. The vulnerability exists because the plugin fails to validate URL protocols (specifically javascript: schemes) on the server side, and the client-side rendering directly inserts unsanitized URLs into anchor href attributes, enabling script execution when users click the malicious button links. While there is no indication of active KEV exploitation, the low attack complexity and low privilege requirements make this a practical threat in multi-author WordPress environments.
Earlier versions of this analysis (1)
The Info Cards – Add Text and Media in Card Layouts WordPress plugin versions up to 2.0.7 contains a Stored Cross-Site Scripting vulnerability in the 'btnUrl' parameter of the Info Cards block that allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript code. The vulnerability exists because the plugin fails to validate URL protocols (specifically javascript: schemes) on the server side, and the client-side rendering directly inserts unsanitized URLs into anchor href attributes, enabling script execution when users click the malicious button links. While there is no indication of active KEV exploitation, the low attack complexity and low privilege requirements make this a practical threat in multi-author WordPress environments.
RemediationAI
Immediately upgrade the Info Cards – Add Text and Media in Card Layouts plugin to a version newer than 2.0.7, which should include URL protocol validation. Check the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/279984d9-f352-467f-a53d-814466d70326 for the patched version number and release date. Until an update is available, restrict the Info Cards block to only trusted administrators and editors by using capability filtering or role-based block visibility plugins, and audit existing Info Cards blocks for suspicious javascript: URLs in the btnUrl parameter. Additionally, monitor user activity on posts and pages containing Info Cards blocks to detect unauthorized modifications, and consider disabling the plugin entirely if it is not in active use.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from a breakdown in URL validation across the application stack. The Info Cards plugin (CPE: cpe:2.3:a:bplugins:info_cards_–_add_text_and_media_in_card_layouts) uses a Gutenberg/WordPress block architecture where server-side PHP (render.php) passes block attributes as JSON-encoded data to the frontend via an HTML data attribute, relying on esc_attr(wp_json_encode()) for escaping. While this function prevents HTML entity injection at the attribute level, it does not validate the semantic content of URLs within the JSON payload. The client-side JavaScript (view.js) then retrieves this data and renders the btnUrl value directly into anchor element href attributes without protocol sanitization. This is a classic instance of CWE-79 (Improper Neutralization of Input During Web Page Generation), where the failure to validate URL schemes at the origin point allows malicious protocols like javascript: to bypass output encoding. The root cause is the false assumption that esc_attr() provides protocol-level validation—it does not.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The Info Cards - Add Text and Media in Card Layouts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btnUrl' parameter within the Info Cards block in all versions up to, and including, 2.0.7. This is due to insufficient input validation on URL schemes, specifically the lack of javascript: protocol filtering. The block's render.php passes all attributes as JSON to the frontend via a data-attributes HTML attribute using esc_attr(wp_json_encode()), which prevents HTML attribute injection but does not validate URL protocols within the JSON data. The client-side view.js then renders the btnUrl value directly as an href attribute on anchor elements without any protocol sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject javascript: URLs that execute arbitrary web scripts when a user clicks the rendered button link.
Executive ViewAI
Organizations using the Info Cards block in all should be aware of moderate risk from CVE-2026-4120, a cross-site scripting vulnerability rated CVSS 6.4. Attackers could inject scripts to steal sessions or perform actions as authenticated users. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: implement CSP headers, enable HttpOnly cookies, deploy WAF XSS rules.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Related Vulnerabilities in WordPress Plugins - Stored XSS Vulnerabilities
View all 3In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
GitHub PoC
Exploit-DB