CVE-2025-5116

The WP Plugin Info Card plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in the 'containerid' parameter. The vulnerable code is located in the Shortcodes.php file, where user-supplied input is not properly filtered before being stored or rendered [1]. This vulnerability affects all versions up to and including 5.3.1, and represents an incomplete patch for the previously reported CVE-2025-31835.

Attack

Vector To exploit this vulnerability, an attacker must first authenticate to the WordPress instance with at least Contributor-level privileges. The attacker can then inject arbitrary web scripts through the 'containerid' parameter, which is processed by the plugin's shortcode functionality. The injected scripts are stored on the server and will execute automatically when any user (including administrators) accesses the affected page.

The impact of successful exploitation includes the ability to execute arbitrary JavaScript in the context of an authenticated user's session. This can lead to session hijacking, manipulation of page content, or redirection to malicious sites. Because the XSS is stored, the attack can persist until the malicious content is removed.

Mitigation

At the time of publication, a patched version has not been released, and users are advised to apply the vendor's fix when available. As a workaround, administrators may restrict Contributor-level capabilities or disable the plugin on untrusted sites until an update is deployed.