Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

102 results · page 1 of 3

Oct 21, 2026WPZOOM Portfolio Lite: Does not check that a user is allowed to edit a post before changing its type and orderCVE-2026-110514 · WordPress plugins & themes · reported by WPScanMedium 4.9
The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their original listings and URLs.
Product
WPZOOM Portfolio Lite
Fixed in
1.4.34
What to do
Update WPZOOM Portfolio Lite to 1.4.34 or newer.
Full record and what to do →NVD record wpscan.com
Oct 10, 2026Portfolio Filter Gallery: Does not perform a per-object authorization check before deleting an attachmentCVE-2026-105977 · WordPress plugins & themes · reported by WPScanLow 2.2
The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators.
Product
Portfolio Filter Gallery
Fixed in
2.2.1
What to do
Update Portfolio Filter Gallery to 2.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 10, 2026Portfolio Filter Gallery: Does not perform proper authorization checks in a set of AJAX actionsCVE-2026-105976 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor role to read, modify and delete other users' galleries as well as site-wide gallery filters.
Product
Portfolio Filter Gallery
Fixed in
2.2.1
What to do
Update Portfolio Filter Gallery to 2.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 13, 2026WPZOOM Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57712 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Portfolio wpzoom-portfolio allows Reflected XSS.This issue affects WPZOOM Portfolio: from n/a through <= 1.4.29.
Product
WPZOOM Portfolio
Affected
up to 1.4.29
What to do
Affects up to 1.4.29. Update WPZOOM Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 10, 2026WPZOOM Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-49069 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM Portfolio allows Reflected XSS. This issue affects WPZOOM Portfolio: from n/a through 1.4.21.
Product
WPZOOM Portfolio
Affected
up to 1.4.21
What to do
Affects up to 1.4.21. Update WPZOOM Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 10, 2026Filterable Portfolio Gallery 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by enteCVE-2021-47929 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Filterable Portfolio Gallery 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by entering payloads in the title field. Attackers can store JavaScript code like image tags with onerror handlers that execute when the gallery is previewed, affecting all users viewing the page.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record filterable-portfolio.com wordpress.org
Apr 8, 2026Grand Portfolio: Cross-Site Request Forgery (CSRF)CVE-2026-39634 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Portfolio grandportfolio allows Cross Site Request Forgery.This issue affects Grand Portfolio: from n/a through <= 3.3.
Product
Grand Portfolio
Affected
up to 3.3
What to do
Affects up to 3.3. Update Grand Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Visual Portfolio, Photo Gallery & Post Grid: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-32537 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nK Visual Portfolio, Photo Gallery & Post Grid visual-portfolio allows PHP Local File Inclusion.This issue affects Visual Portfolio, Photo Gallery & Post Grid: from n/a through <= 3.5.1.
Product
Visual Portfolio, Photo Gallery & Post Grid
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update Visual Portfolio, Photo Gallery & Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026VW Portfolio: Missing AuthorizationCVE-2026-32437 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vowelweb VW Portfolio vw-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Portfolio: from n/a through <= 1.3.3.
Product
VW Portfolio
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update VW Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Perfect Portfolio: Missing AuthorizationCVE-2026-32345 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Perfect Portfolio perfect-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Perfect Portfolio: from n/a through <= 1.2.4.
Product
Perfect Portfolio
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Perfect Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026DesignThemes Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27385 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio designthemes-portfolio allows Reflected XSS.This issue affects DesignThemes Portfolio: from n/a through <= 1.3.
Product
DesignThemes Portfolio
Affected
up to 1.3
What to do
Affects up to 1.3. Update DesignThemes Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Portfolio Builder: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69375 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SolverWp Portfolio Builder swp-portfolio allows PHP Local File Inclusion.This issue affects Portfolio Builder: from n/a through <= 1.2.5.
Product
Portfolio Builder
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Portfolio Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Ultra Portfolio: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69180 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themepassion Ultra Portfolio ultra-portfolio allows Blind SQL Injection.This issue affects Ultra Portfolio: from n/a through <= 6.7.
Product
Ultra Portfolio
Affected
up to 6.7
What to do
Affects up to 6.7. Update Ultra Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Behance Portfolio Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59135 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
Product
Behance Portfolio Manager
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025GS Portfolio for Envato: Missing AuthorizationCVE-2025-62755 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in GS Plugins GS Portfolio for Envato gs-envato-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GS Portfolio for Envato: from n/a through <= 1.4.2.
Product
GS Portfolio for Envato
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update GS Portfolio for Envato to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Portfolio Gallery: Missing AuthorizationCVE-2025-62098 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in totalsoft Portfolio Gallery gallery-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Portfolio Gallery: from n/a through <= 1.4.8.
Product
Portfolio Gallery
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Portfolio Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Behance Portfolio Manager: Cross-Site Request Forgery (CSRF)CVE-2025-59137 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
Product
Behance Portfolio Manager
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 30, 2025HomeFix Elementor Portfolio: Missing AuthorizationCVE-2025-68981 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in designthemes HomeFix Elementor Portfolio homefix-ele-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HomeFix Elementor Portfolio: from n/a through <= 1.0.1.
Product
HomeFix Elementor Portfolio
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update HomeFix Elementor Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 30, 2025WeDesignTech Portfolio: Missing AuthorizationCVE-2025-68980 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in designthemes WeDesignTech Portfolio wedesigntech-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Portfolio: from n/a through <= 1.0.2.
Product
WeDesignTech Portfolio
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update WeDesignTech Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 30, 2025DesignThemes Portfolio Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68977 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio Addon designthemes-portfolio-addon allows DOM-Based XSS.This issue affects DesignThemes Portfolio Addon: from n/a through <= 1.5.
Product
DesignThemes Portfolio Addon
Affected
up to 1.5
What to do
Affects up to 1.5. Update DesignThemes Portfolio Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025Salient Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68078 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNectar Salient Portfolio salient-portfolio allows Stored XSS.This issue affects Salient Portfolio: from n/a through <= 1.8.2.
Product
Salient Portfolio
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update Salient Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Themify Portfolio Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67533 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Portfolio Post themify-portfolio-post allows Stored XSS.This issue affects Themify Portfolio Post: from n/a through <= 1.3.0.
Product
Themify Portfolio Post
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Themify Portfolio Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Portfolio and Projects: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67470 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Essential Plugin Portfolio and Projects portfolio-and-projects allows Retrieve Embedded Sensitive Data.This issue affects Portfolio and Projects: from n/a through <= 1.5.5.
Product
Portfolio and Projects
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Portfolio and Projects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 6, 2025Social Feed Gallery Portfolio: Stored Cross-Site ScriptingCVE-2025-13896 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Social Feed Gallery Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the [igp-wp] shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Social Feed Gallery Portfolio
Affected
up to 1.3
What to do
Affects up to 1.3. Update Social Feed Gallery Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 5, 2025Premium Portfolio Features for Phlox: Local File InclusionCVE-2025-12497 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.3.10 via the 'args[extra_template_path]' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Product
Premium Portfolio Features for Phlox
Affected
up to 2.3.10
What to do
Affects up to 2.3.10. Update Premium Portfolio Features for Phlox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 4, 2025Bootstrap Multi-language Responsive Portfolio: Stored Cross-Site ScriptingCVE-2025-11753 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Bootstrap Multi-language Responsive Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Bootstrap Multi-language Responsive Portfolio
Affected
up to 1.0
What to do
Affects up to 1.0. Update Bootstrap Multi-language Responsive Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Sep 22, 2025Penci Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59586 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Portfolio penci-portfolio allows DOM-Based XSS.This issue affects Penci Portfolio: from n/a through <= 3.5.
Product
Penci Portfolio
Affected
up to 3.5
What to do
Affects up to 3.5. Update Penci Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58245 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bestweblayout Portfolio portfolio allows DOM-Based XSS.This issue affects Portfolio : from n/a through <= 2.58.
Product
Portfolio
Affected
up to 2.58
What to do
Affects up to 2.58. Update Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Advance Portfolio Grid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57982 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBean Advance Portfolio Grid advance-portfolio-grid allows Stored XSS.This issue affects Advance Portfolio Grid: from n/a through <= 1.07.6.
Product
Advance Portfolio Grid
Affected
up to 1.07.6
What to do
Affects up to 1.07.6. Update Advance Portfolio Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Behance Portfolio Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57913 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
Product
Behance Portfolio Manager
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 10, 2025Responsive Filterable Portfolio: Arbitrary file uploadsCVE-2025-10049 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Responsive Filterable Portfolio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the HdnMediaSelection_image field in all versions up to, and including, 1.0.24. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Responsive Filterable Portfolio
Affected
up to 1.0.24
What to do
Affects up to 1.0.24. Update Responsive Filterable Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 20, 2025Ultra Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49420 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themepassion Ultra Portfolio ultra-portfolio allows Reflected XSS.This issue affects Ultra Portfolio: from n/a through <= 6.7.
Product
Ultra Portfolio
Affected
up to 6.7
What to do
Affects up to 6.7. Update Ultra Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Cube Portfolio: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52823 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ovatheme Cube Portfolio cubeportfolio allows SQL Injection.This issue affects Cube Portfolio: from n/a through <= 1.16.8.
Product
Cube Portfolio
Affected
up to 1.16.8
What to do
Affects up to 1.16.8. Update Cube Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 22, 2025The Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery plugin for WordPress is vulnerabCVE-2025-7644 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URLs in all widgets in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 1.6.7
What to do
Affects up to 1.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 3, 2025Portfolio for Elementor & Image Gallery | PowerFolio: Stored Cross-Site ScriptingCVE-2025-7046 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Portfolio for Elementor & Image Gallery | PowerFolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS Attributes of Plugin's widgets in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue was partially fixed in version 3.2.0 and fully fixed in version 3.2.1
Product
Portfolio for Elementor & Image Gallery | PowerFolio
Affected
up to 3.2.0
Fixed in
3.2.0
What to do
Update Portfolio for Elementor & Image Gallery | PowerFolio to 3.2.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2025Behance Portfolio Manager: Missing AuthorizationCVE-2025-29010 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
Product
Behance Portfolio Manager
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025CWW Portfolio: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39359 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codeworkweb CWW Portfolio cww-portfolio allows PHP Local File Inclusion.This issue affects CWW Portfolio: from n/a through <= 1.3.1.
Product
CWW Portfolio
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update CWW Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025Behance Portfolio Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32124 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Blind SQL Injection.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
Product
Behance Portfolio Manager
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Opal Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31748 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpopal Opal Portfolio opal-portfolios allows Stored XSS.This issue affects Opal Portfolio: from n/a through <= 1.0.4.
Product
Opal Portfolio
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Opal Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Behance Portfolio Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31526 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows SQL Injection.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
Product
Behance Portfolio Manager
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 28, 2025Modal Portfolio: Stored Cross-Site ScriptingCVE-2024-13851 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Modal Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.7.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Modal Portfolio
Affected
up to 1.7.4.2
What to do
Affects up to 1.7.4.2. Update Modal Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 28, 2025WordPress Portfolio Builder – Portfolio Gallery: Stored Cross-Site ScriptingCVE-2025-1757 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pfhub_portfolio' and 'pfhub_portfolio_portfolio' shortcodes in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WordPress Portfolio Builder – Portfolio Gallery
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update WordPress Portfolio Builder – Portfolio Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025WordPress Portfolio Builder – Portfolio Gallery: Unauthorized modification of dataCVE-2024-13231 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'add_video' function in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to add arbitrary videos to any portfolio gallery.
Product
WordPress Portfolio Builder – Portfolio Gallery
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update WordPress Portfolio Builder – Portfolio Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 4, 2025WP Projects Portfolio with Client Testimonials: Does not have CSRF check in some placesCVE-2024-13115 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
WP Projects Portfolio with Client Testimonials
Affected
up to 3.0
What to do
Affects up to 3.0. Update WP Projects Portfolio with Client Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 4, 2025WP Projects Portfolio with Client Testimonials: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13114 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
WP Projects Portfolio with Client Testimonials
Affected
up to 3.0
What to do
Affects up to 3.0. Update WP Projects Portfolio with Client Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jan 31, 2025DPortfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24534 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dinamiko DPortfolio dportfolio allows Reflected XSS.This issue affects DPortfolio: from n/a through <= 2.0.
Product
DPortfolio
Affected
up to 2.0
What to do
Affects up to 2.0. Update DPortfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025HM Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23522 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matthew Haines-Young HM Portfolio hm-portfolio allows Reflected XSS.This issue affects HM Portfolio: from n/a through <= 1.1.1.
Product
HM Portfolio
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update HM Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Winning Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23865 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pressfore Winning Portfolio winning-portfolio allows Stored XSS.This issue affects Winning Portfolio: from n/a through <= 1.1.
Product
Winning Portfolio
Affected
up to 1.1
What to do
Affects up to 1.1. Update Winning Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Easy Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23796 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tushar Patel Easy Portfolio easy-portfolio allows Stored XSS.This issue affects Easy Portfolio: from n/a through <= 1.3.
Product
Easy Portfolio
Affected
up to 1.3
What to do
Affects up to 1.3. Update Easy Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 9, 2025GS Insever Portfolio: Unauthorized modification of dataCVE-2024-12249 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The GS Insever Portfolio plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings() function in all versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's CSS settings.
Product
GS Insever Portfolio
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update GS Insever Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.