WP Plugin Info Card EUVD-2026-94888

Exploitation requires an authenticated WordPress user with at least low-level posting/content privileges (PR:L) to store the malicious payload in a field handled by the WP Plugin Info Card plugin, plus a separate victim (typically an administrator or another user) who must subsequently view the page rendering the plugin info card (UI:R). These two factors - prior authenticated access and required victim interaction - are the primary limiting conditions; the flaw is not exploitable by fully unauthenticated attackers and is not triggered automatically. It affects WP Plugin Info Card versions from the earliest through 6.3.5. No non-default configuration appears necessary beyond having the plugin installed and active.

This is a moderate-risk, authenticated Stored XSS (CWE-79) in the WP Plugin Info Card WordPress plugin, with a vendor-assigned CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The vector is consistent and internally coherent for a stored XSS: network-reachable (AV:N), low attack complexity (AC:L), but it requires an authenticated contributor-level account (PR:L) AND a victim to render the injected page (UI:R), with a changed scope (S:C) reflecting execution in the victim's browser context. No EPSS score, KEV listing, or public POC is present in the provided data, so the only exploitation signal is the CVSS vector itself - exploitation probability cannot be quantified from this input. There is no conflict between signals, but the real-world priority is tempered by the two hard gating requirements (prior authenticated access plus user interaction), which make this far less urgent than an unauthenticated RCE despite the 'network' attack vector. Treat as a standard patch-cycle item rather than an emergency: a credentialed low-privilege insider or a compromised contributor account is the realistic threat model, not mass internet-wide exploitation.

An attacker with a low-privileged authenticated WordPress account (e.g., contributor or author) injects a malicious script payload into a field rendered by the WP Plugin Info Card plugin, which is stored persistently. When an administrator or other user later views the page containing the plugin info card, the script executes in their browser session, potentially stealing session cookies or performing actions as that user. No public exploit code was identified in the provided data, so exploitation currently requires an attacker to develop the payload independently.