CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in portfoliohub WordPress Portfolio Builder – Portfolio Gallery uber-grid allows Stored XSS.This issue affects WordPress Portfolio Builder – Portfolio Gallery: from n/a through <= 1.1.7.
Explanation of Vulnerability in Simple Terms
The WordPress Portfolio Builder plugin contains a stored cross-site scripting (XSS) vulnerability in versions up to 1.1.7. An authenticated admin user with high privileges can inject malicious scripts into portfolio content. When other users view the affected portfolio, the scripts execute in their browsers, potentially compromising their sessions or stealing data. The vulnerability requires admin interaction to inject the payload.
What an attacker can do
Inject malicious scripts that execute when other users view the portfolio, potentially stealing session data or performing actions on their behalf.
Potential impact on your site
Visitors to your portfolio pages could have their sessions hijacked or personal data stolen if an admin account is compromised.
Conditions required to exploit
Attacker must have admin-level access to the WordPress site and trick an admin into visiting a malicious page or link.
Key dates
External resources
Related vulnerabilities
