Stored Cross-Site Scripting Vulnerability in WP Plugin Info Card by WordPress
CVE-2025-5116
6.4MEDIUM
What is CVE-2025-5116?
The WP Plugin Info Card plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'containerid' parameter in all versions up to 5.3.1. This vulnerability arises from inadequate input sanitization and output escaping, allowing authenticated attackers with Contributor-level access or higher to inject malicious web scripts. The injected scripts can then execute in the context of users visiting the compromised pages, posing significant security risks. This issue is a result of an incomplete patch related to a previous vulnerability.
Affected Version(s)
WP Plugin Info Card * <= 5.3.1