CVE-2026-62127: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in MediaRon LLC WP Plugin Info Card

The vulnerability CVE-2026-62127 in MediaRon LLC's WP Plugin Info Card allows stored cross-site scripting due to improper input neutralization during web page generation. This enables an attacker with low privileges and requiring user interaction to inject malicious scripts that can affect the confidentiality, integrity, and availability of the affected system. The issue affects all versions from initial release through 6.3.5, with no explicit patch information provided.

Successful exploitation could lead to execution of arbitrary scripts in the context of other users, potentially resulting in data disclosure, modification, or denial of service. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and scope change, with partial impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with user input and consider temporary mitigations such as input validation or disabling the vulnerable plugin if feasible.