Stored Cross-Site Scripting Vulnerability in WP Plugin Info Card by WordPress
CVE-2025-5116

6.4MEDIUM

Key Information:

Vendor

WordPress

Vendor
CVE Published:
3 June 2025

What is CVE-2025-5116?

The WP Plugin Info Card plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'containerid' parameter in all versions up to 5.3.1. This vulnerability arises from inadequate input sanitization and output escaping, allowing authenticated attackers with Contributor-level access or higher to inject malicious web scripts. The injected scripts can then execute in the context of users visiting the compromised pages, posing significant security risks. This issue is a result of an incomplete patch related to a previous vulnerability.

Affected Version(s)

WP Plugin Info Card * <= 5.3.1

References

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter Thaleikis
.
CVE-2025-5116 : Stored Cross-Site Scripting Vulnerability in WP Plugin Info Card by WordPress