Stored Cross-Site Scripting Vulnerability in WP Plugin Info Card by WordPress

CVE-2025-5116

What is CVE-2025-5116?

The WP Plugin Info Card plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'containerid' parameter in all versions up to 5.3.1. This vulnerability arises from inadequate input sanitization and output escaping, allowing authenticated attackers with Contributor-level access or higher to inject malicious web scripts. The injected scripts can then execute in the context of users visiting the compromised pages, posing significant security risks. This issue is a result of an incomplete patch related to a previous vulnerability.

References