Threat Database

Threat Entry Updated 2026-06-17

Portfolio - Cross-Site Scripting (XSS) (CVE-2025-58245)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bestweblayout Portfolio portfolio allows DOM-Based XSS.This issue affects Portfolio : from n/a through

PLUGIN Portfolio

CVE-2025-58245

MEDIUM CVSS 5.9 2025-09-22

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Portfolio - Cross-Site Scripting (XSS) (CVE-2024-11900)

The Portfolio – Filterable Masonry Portfolio Gallery for Professionals plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'portfolio-pro' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Portfolio

CVE-2024-11900

MEDIUM CVSS 6.4 2024-12-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Portfolio - Cross-Site Scripting (XSS) (CVE-2023-23685)

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in RadiusTheme Portfolio – WordPress Portfolio plugin

PLUGIN Portfolio

CVE-2023-23685

MEDIUM CVSS 6.5 2023-04-04

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Portfolio - Cross-Site Request Forgery (CSRF) (CVE-2015-6523)

Cross-site request forgery (CSRF) vulnerability in the Portfolio plugin before 1.05 for WordPress allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via a request to the instagram-portfolio page in wp-admin/options-general.php.

PLUGIN Portfolio

CVE-2015-6523

MEDIUM CVSS 6.8 2015-08-19

Risk Score

Open Full Technical Breakdown