The Child Pages Card WordPress plugin versions prior to 1.09 contain a CWE-79 Cross-Site Scripting vulnerability. Specifically, some shortcode attributes are not sanitized or escaped before being rendered on pages. This enables users with contributor or higher privileges to perform stored XSS attacks, potentially impacting confidentiality and integrity by executing arbitrary scripts in the context of other users viewing the affected pages. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, privileges required at the contributor level, user interaction required, and partial impact on confidentiality and integrity without availability impact. No official patch or remediation guidance is currently documented.

Successful exploitation allows an attacker with contributor or higher privileges to inject and store malicious scripts that execute when other users view the affected pages. This can lead to partial disclosure of sensitive information and modification of content or user interface elements. There is no direct impact on system availability. The vulnerability requires user interaction and privileges at the contributor level or above.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling the Child Pages Card plugin if possible. Monitor for updates from the plugin vendor regarding a security patch.