Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: wpzoom Component: Wpzoom Portfolio Clear all filters
TI-2024-07672 CVE-2024-8276 · GHSA-j2ww-8383-6mw8

Cross-site scripting in WPZOOM Portfolio Lite – Filterable Portfolio Plugin

Priority LOW 31

The WPZOOM Portfolio Lite – Filterable Portfolio Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ attribute within the 'wp:wpzoom-blocks' Gutenberg block in all versions up to, and…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00373 Published 2024-08-31 No fix listed CWE-79
TI-2022-04385 CVE-2022-4789 · GHSA-xx8q-8jxm-3v8c

WPZOOM Portfolio < 1.2.2 - Contributor+ Stored XSS via Shortcode

Priority MEDIUM 58

The WPZOOM Portfolio WordPress plugin before 1.2.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00476 Published 2023-01-23 Fixed in 1.2.2