Threat Entry Updated 2025-01-09

CVE-2024-12249 - Gs Insever Portfolio Plugin

The GS Insever Portfolio plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings() function in all versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's CSS settings.

PLUGIN Gs Insever Portfolio

CVE-2024-12249

MEDIUM CVSS 4.3 2025-01-09

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2023-0539 - Gs Insever Portfolio Plugin

The GS Insever Portfolio WordPress plugin before 1.4.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

PLUGIN Gs Insever Portfolio

CVE-2023-0539

MEDIUM CVSS 5.4 2023-02-27

Risk Score

Open Full Technical Breakdown