Vulnerabilities and security researches forwpzoom-portfolio wpzoom-portfolio

Jun 06, 2024

CVE, Research URL: CVE-2022-4789
Home page URL: Security reports for WPZOOM Portfolio
Application: WPZOOM Portfolio
Date: Jan 23, 2023
Research Description: The WPZOOM Portfolio WordPress plugin before 1.2.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Affected versions: max 1.2.2.
Status: vulnerable

Sep 01, 2024

CVE, Research URL: CVE-2024-8276
Home page URL: Security reports for WPZOOM Portfolio
Application: WPZOOM Portfolio
Date: Aug 31, 2024
Research Description: The WPZOOM Portfolio Lite – Filterable Portfolio Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ attribute within the 'wp:wpzoom-blocks' Gutenberg block in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 1.4.5.
Status: vulnerable

Jun 12, 2026

CVE, Research URL: CVE-2026-49069
Home page URL: Security reports for WPZOOM Portfolio
Application: WPZOOM Portfolio
Date: Jun 10, 2026
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM Portfolio allows Reflected XSS. This issue affects WPZOOM Portfolio: from n/a through 1.4.21.
Affected versions: max 1.4.22.
Status: vulnerable

Jul 14, 2026

CVE, Research URL: CVE-2026-57712
Home page URL: Security reports for WPZOOM Portfolio
Application: WPZOOM Portfolio
Date: Jul 13, 2026
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Portfolio wpzoom-portfolio allows Reflected XSS.This issue affects WPZOOM Portfolio: from n/a through <= 1.4.29.
Affected versions: max 1.4.30.
Status: vulnerable

Oct 23, 2026

CVE, Research URL: CVE-2026-110514
Home page URL: Security reports for WPZOOM Portfolio
Application: WPZOOM Portfolio
Date: Oct 21, 2026
Research Description: The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their original listings and URLs.
Affected versions: max 1.4.34.
Status: vulnerable