TI-2018-12852 CVE-2018-18087 · GHSA-6wpq-76c5-9mpqThe Bixie Portfolio plugin 1.2.0 for Pagekit has XSS: a logged-in user who has the…Priority LOW 26The Bixie Portfolio plugin 1.2.0 for Pagekit has XSS: a logged-in user who has the "Manage portfolio" privilege can inject arbitrary web script or HTML via the Image URL field in the portfolio editor.CVSS 3.0MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00684 · Published 2018-10-09 · No fix listed CWE-79