CVE-2026-4120 Details
Description
The Info Cards – Add Text and Media in Card Layouts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btnUrl' parameter within the Info Cards block in all versions up to, and including, 2.0.7. This is due to insufficient input validation on URL schemes, specifically the lack of javascript: protocol filtering. The block's render.php passes all attributes as JSON to the frontend via a data-attributes HTML attribute using esc_attr(wp_json_encode()), which prevents HTML attribute injection but does not validate URL protocols within the JSON data. The client-side view.js then renders the btnUrl value directly as an href attribute on anchor elements without any protocol sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject javascript: URLs that execute arbitrary web scripts when a user clicks the rendered button link.
A stored cross-site scripting vulnerability has been identified in the Info Cards – Add Text and Media in Card Layouts plugin for WordPress, affecting all versions through 2.0.7. The issue arises from inadequate input validation on URL schemes, particularly the absence of filtering for 'javascript:' protocols. When the Info Cards block is rendered, all attributes are passed as JSON to the frontend via a data-attributes HTML attribute. This method, while preventing direct HTML attribute injection, fails to validate URL protocols within the JSON data. Consequently, the client-side script renders the 'btnUrl' value directly as an href attribute on anchor elements without any protocol sanitization. This flaw allows authenticated attackers with Contributor-level access or higher to inject 'javascript:' URLs that execute arbitrary scripts when the user clicks the corresponding button link.
Users are advised to update the Info Cards WordPress plugin to version 2.0.8 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 19, 2026CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Info Cards | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 19, 2026 | New CVE Received | [email protected] |