CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PWR Plugins Portfolio & Image Gallery for WordPress | PowerFolio allows Stored XSS.This issue affects Portfolio & Image Gallery for WordPress | PowerFolio: from n/a through 3.1.
Explanation of Vulnerability in Simple Terms
The PowerFolio plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to 3.1. An authenticated user with low privileges can inject malicious scripts into the plugin's data. When other users, including site administrators, view the affected content, the scripts execute in their browsers. This can lead to unauthorized actions, session hijacking, or credential theft.
What an attacker can do
Inject malicious scripts that execute when other users view the plugin's content, potentially stealing sessions or performing actions as those users.
Potential impact on your site
Authenticated users can inject scripts affecting other site visitors and admins; requires immediate plugin update to prevent account compromise.
Conditions required to exploit
Attacker must have a low-privilege WordPress account and the victim must view the page containing the injected script.
Key dates
External resources
Related vulnerabilities
