What the vulnerability does
01Description
The Info Cards – Add Text and Media in Card Layouts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btnUrl' parameter within the Info Cards block in all versions up to, and including, 2.0.7. This is due to insufficient input validation on URL schemes, specifically the lack of javascript: protocol filtering. The block's render.php passes all attributes as JSON to the frontend via a data-attributes HTML attribute using esc_attr(wp_json_encode()), which prevents HTML attribute injection but does not validate URL protocols within the JSON data. The client-side view.js then renders the btnUrl value directly as an href attribute on anchor elements without any protocol sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject javascript: URLs that execute arbitrary web scripts when a user clicks the rendered button link.
Explanation of Vulnerability in Simple Terms
02Summary
The Info Cards plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to 2.0.7. An authenticated user with low privileges can inject malicious scripts into card content that execute in the browsers of other site visitors. The vulnerability affects the scope beyond the vulnerable component, potentially compromising site security and visitor data.
What an attacker can do
03Attacker Capabilities
Inject malicious JavaScript that runs in other users' browsers when they view affected card content.
Potential impact on your site
04Site Impact
Malicious scripts can steal visitor data, deface content, or redirect users to phishing sites without your knowledge.
Conditions required to exploit
05Prerequisites
Attacker must have a WordPress user account with low-level permissions (e.g., contributor or editor role).
Key dates
06Disclosure timeline
March 19, 2026
CVE published
April 8, 2026
Record updated
