CVE-2026-2434 is a stored cross-site scripting vulnerability in the Pz-LinkCard WordPress plugin, affecting all versions up to 2.5.8.1. The issue is due to improper neutralization of input in the 'blogcard' shortcode attributes, allowing authenticated users with Contributor-level privileges or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses the compromised page, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 score of 6.4, reflecting network attack vector, low attack complexity, and privileges required at the contributor level without user interaction. No official fix or patch has been published, and no known exploits are reported in the wild.

Successful exploitation allows authenticated users with Contributor-level access or above to inject persistent malicious scripts into pages via the 'blogcard' shortcode attributes. These scripts execute in the context of any user viewing the infected page, potentially leading to information disclosure or other client-side impacts. The vulnerability does not affect availability and requires authenticated access, limiting the scope of impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the Pz-LinkCard plugin if feasible. Monitor for updates from the vendor or WordPress plugin repository for patches addressing this vulnerability.