Executive brief
The kk blog card plugin for WordPress, which allows users to display link previews in posts, contains a security flaw that allows authenticated users to inject malicious scripts. An attacker with contributor-level access or higher can use a specific shortcode to embed code that will run in the browser of any visitor who views the affected page. This could lead to unauthorized actions being performed on behalf of site visitors or administrators.
Technical details
The kk blog card plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'blog-card' shortcode in all versions up to, and including, 1.3. The vulnerability exists because the plugin fails to sufficiently sanitize and escape the 'href' and 'type' attributes within the shortcode callback function located in kk-blog-card-shortcode.php. These attributes are concatenated directly into HTML attribute contexts. An authenticated attacker with contributor-level permissions or higher can exploit this to inject arbitrary web scripts into pages. These scripts will execute in the security context of any user who views the compromised page.
Affected products
- kk blog card plugin for WordPress kk blog card Up to and including 1.3
Timeline
- 2026-06-09: disclosed: Initial publication of the vulnerability advisory.
- 2026-06-09: advisory: NVD and Wordfence published advisory details.