The WP Plugin Info Card plugin for WordPress suffers from a DOM-based cross-site scripting vulnerability due to improper input neutralization during web page generation. This allows an attacker with low privileges and requiring user interaction to potentially execute arbitrary scripts in the context of the affected site. The vulnerability affects all versions up to 5.3.0. No known exploits in the wild have been reported, and no patch or vendor advisory has been provided yet.

Successful exploitation could lead to partial confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). This means an attacker could potentially execute malicious scripts that affect user data, modify content, or disrupt availability to some extent. However, exploitation requires user interaction and some privileges, limiting the ease of attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting plugin usage to trusted users and avoid exposing the vulnerable functionality to untrusted input. Monitor for updates from the vendor for an official patch.