Security Alert Summary
The Pz-LinkCard WordPress plugin contains a stored Cross-Site Scripting (XSS) vulnerability in the blogcard shortcode attributes. Authenticated users with Contributor-level access and above can inject arbitrary web scripts into pages; those scripts will execute whenever a user views a page containing the injected content.
CVE Details
- CVE ID: CVE-2026-2434
- Affected component: Pz-LinkCard plugin for WordPress
- Affected versions: All versions up to and including 2.5.8.1
- Published: April 17, 2026 at 11:16:12 PM UTC
- Last modified: April 17, 2026 at 11:16:12 PM UTC
- CVSS v3.1 base score: 6.4 (MEDIUM)
- CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Authentication / privileges / user interaction:
- Privileges Required: LOW (an authenticated user account is required)
- User Interaction: NONE
- Attack Vector: NETWORK
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- Scope: CHANGED
- CWE / weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
This is a stored Cross-Site Scripting vulnerability caused by insufficient input sanitization and output escaping of the blogcard shortcode attributes. When certain shortcode attributes are not properly sanitized before being stored or not escaped on output, an authenticated user can include HTML or JavaScript that is later rendered in a page context.
The vulnerability is specifically tied to how the plugin handles blogcard shortcode attributes (see the plugin code references below). Because the injected content is stored and served as part of page output, any visitor that loads the affected page may execute the injected script in their browser.
Impact is limited to what can be achieved via script execution in the browser: attackers could manipulate page content for that visitor, attempt to read data accessible to the page (for example, client-side tokens or visible information), or perform actions on behalf of that user within the limits of their session and the browser context. The available CVSS metrics indicate confidentiality and integrity impacts are LOW and there is no direct availability impact.
How This Could Impact Your Website
Consider a small website with several user roles: a site owner, one or more internal staff editors, and external contributors or contractors who submit content. If a contributor or contractor is able to add or edit content using the vulnerable blogcard shortcode, they could embed a script that runs when an editor or visitor opens the page. Practical consequences include exposure of information visible to the page, potential modification of page appearance for visitors, and an increased risk of targeted phishing or social engineering if emails or other user-facing data are gathered.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce the attack surface.
- Monitor site activity and logs for unusual behavior or unexpected content changes.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/pz-linkcard/tags/2.5.8/pz-linkcard.php#L442
- https://plugins.trac.wordpress.org/browser/pz-linkcard/tags/2.5.8/pz-linkcard.php#L636
- https://plugins.trac.wordpress.org/browser/pz-linkcard/trunk/pz-linkcard.php#L636
- https://www.wordfence.com/threat-intel/vulnerabilities/id/687ffac2-1f07-4adb-ba12-5f2ea357ea7e?source=cve
