What is the CVSS score of CVE-2026-4120?

CVE-2026-4120 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-4120?

Organizations using the Info Cards block in all should be aware of moderate risk from CVE-2026-4120, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-4120?

Within 30 days: Identify affected systems running the Info Cards block in all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

PHP CVE-2026-4120

EUVD-2026-13072 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-19 Wordfence

WordPress PHP XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 19, 2026 - 07:15 euvd

EUVD-2026-13072

Analysis Generated

Mar 19, 2026 - 07:15 vuln.today

CVE Published

Mar 19, 2026 - 06:46 nvd

MEDIUM 6.4

DescriptionCVE.org

The Info Cards - Add Text and Media in Card Layouts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btnUrl' parameter within the Info Cards block in all versions up to, and including, 2.0.7. This is due to insufficient input validation on URL schemes, specifically the lack of javascript: protocol filtering. The block's render.php passes all attributes as JSON to the frontend via a data-attributes HTML attribute using esc_attr(wp_json_encode()), which prevents HTML attribute injection but does not validate URL protocols within the JSON data. The client-side view.js then renders the btnUrl value directly as an href attribute on anchor elements without any protocol sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject javascript: URLs that execute arbitrary web scripts when a user clicks the rendered button link.

AnalysisAI

The Info Cards - Add Text and Media in Card Layouts WordPress plugin versions up to 2.0.7 contains a Stored Cross-Site Scripting vulnerability in the 'btnUrl' parameter of the Info Cards block that allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript code. The vulnerability exists because the plugin fails to validate URL protocols (specifically javascript: schemes) on the server side, and the client-side rendering directly inserts unsanitized URLs into anchor href attributes, enabling script execution when users click the malicious button links. While there is no indication of active KEV exploitation, the low attack complexity and low privilege requirements make this a practical threat in multi-author WordPress environments.

Technical ContextAI

The vulnerability stems from a breakdown in URL validation across the application stack. The Info Cards plugin (CPE: cpe:2.3:a:bplugins:info_cards_–_add_text_and_media_in_card_layouts) uses a Gutenberg/WordPress block architecture where server-side PHP (render.php) passes block attributes as JSON-encoded data to the frontend via an HTML data attribute, relying on esc_attr(wp_json_encode()) for escaping. While this function prevents HTML entity injection at the attribute level, it does not validate the semantic content of URLs within the JSON payload. The client-side JavaScript (view.js) then retrieves this data and renders the btnUrl value directly into anchor element href attributes without protocol sanitization. This is a classic instance of CWE-79 (Improper Neutralization of Input During Web Page Generation), where the failure to validate URL schemes at the origin point allows malicious protocols like javascript: to bypass output encoding. The root cause is the false assumption that esc_attr() provides protocol-level validation—it does not.

RemediationAI

Immediately upgrade the Info Cards – Add Text and Media in Card Layouts plugin to a version newer than 2.0.7, which should include URL protocol validation. Check the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/279984d9-f352-467f-a53d-814466d70326 for the patched version number and release date. Until an update is available, restrict the Info Cards block to only trusted administrators and editors by using capability filtering or role-based block visibility plugins, and audit existing Info Cards blocks for suspicious javascript: URLs in the btnUrl parameter. Additionally, monitor user activity on posts and pages containing Info Cards blocks to detect unauthorized modifications, and consider disabling the plugin entirely if it is not in active use.