The Info Cards plugin for WordPress improperly neutralizes input during web page generation, specifically failing to filter out javascript: URL schemes in the 'btnUrl' parameter. While the plugin encodes attributes as JSON to prevent HTML attribute injection, it does not validate URL protocols before rendering them in anchor href attributes on the client side. This flaw enables stored XSS attacks by authenticated users with Contributor or higher privileges, who can inject malicious javascript URLs that execute arbitrary scripts upon user interaction.

This vulnerability allows authenticated users with Contributor-level access or above to perform stored cross-site scripting attacks. Successful exploitation can lead to arbitrary script execution in the context of users who click the malicious links, potentially resulting in session hijacking, privilege escalation, or other client-side impacts. The CVSS score of 6.4 reflects a medium severity with low complexity and no user interaction required beyond clicking the link.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin. Avoid clicking on suspicious links generated by the Info Cards plugin. Monitor vendor channels for updates and apply patches promptly once released.