The WP Plugin Info Card plugin for WordPress has a security vulnerability that allows attackers to inject harmful code into pages. This can happen because the plugin does not properly clean the input and output of the ‘containerid’ parameter. As a result, attackers with at least Contributor-level access can add scripts to pages that will run when a user visits them. This problem is caused by a partial fix for a previous issue.