Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
240 results · page 1 of 5
Oct 21, 2026WPZOOM Portfolio Lite: Does not check that a user is allowed to edit a post before changing its type and orderCVE-2026-110514 · WordPress plugins & themes · reported by WPScanMedium 4.9
The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their original listings and URLs.
- Product
- WPZOOM Portfolio Lite
- Fixed in
- 1.4.34
- What to do
- Update WPZOOM Portfolio Lite to 1.4.34 or newer.
Oct 20, 2026Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access).CVE-2026-91399 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.3
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-23.12.20, 24.12.0-24.12.16 and 25.12.0-25.12.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
- Product
- Primavera P6 Enterprise Project Portfolio Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access).CVE-2026-91376 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-23.12.20, 24.12.0-24.12.16 and 25.12.0-25.12.8. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N).
- Product
- Primavera P6 Enterprise Project Portfolio Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026Portfolio Filter Gallery: Does not perform a per-object authorization check before deleting an attachmentCVE-2026-105977 · WordPress plugins & themes · reported by WPScanLow 2.2
The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators.
- Product
- Portfolio Filter Gallery
- Fixed in
- 2.2.1
- What to do
- Update Portfolio Filter Gallery to 2.2.1 or newer.
Oct 10, 2026Portfolio Filter Gallery: Does not perform proper authorization checks in a set of AJAX actionsCVE-2026-105976 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor role to read, modify and delete other users' galleries as well as site-wide gallery filters.
- Product
- Portfolio Filter Gallery
- Fixed in
- 2.2.1
- What to do
- Update Portfolio Filter Gallery to 2.2.1 or newer.
Aug 11, 2026ishankportfolio is a portfolio website.CVE-2026-48771 · Other software · Ishankjha740 · reported by GitHubHigh 8.2
ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side database configuration and insufficient access control policies. Applications using publicly exposed database credentials or permissive database rules may allow unauthorised users to read, modify, or abuse stored form submission data. This could impact personally identifiable information (PII) submitted through the website contact form, including names, email addresses, phone numbers, and messages. The issue has been patched in version 1.0.1. Users unable to upgrade immediately can reduce risk by disabling public read/write database access, rotating exposed API keys, restricting database policies to authenticated requests only, moving sensitive operations to secure backend/serverless functions, and/or monitoring database activity logs for suspicious access.
- Product
- ishankportfolio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations).CVE-2026-60988 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in takeover of Oracle Project Portfolio Analysis. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle Project Portfolio Analysis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations).CVE-2026-60987 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.1
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Portfolio Analysis accessible data as well as unauthorized read access to a subset of Oracle Project Portfolio Analysis accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
- Product
- Oracle Project Portfolio Analysis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations).CVE-2026-60986 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.1
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Portfolio Analysis accessible data as well as unauthorized access to critical data or complete access to all Oracle Project Portfolio Analysis accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
- Product
- Oracle Project Portfolio Analysis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations).CVE-2026-60985 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.1
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Portfolio Analysis accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Project Portfolio Analysis. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).
- Product
- Oracle Project Portfolio Analysis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations).CVE-2026-60984 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.1
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Portfolio Analysis accessible data as well as unauthorized read access to a subset of Oracle Project Portfolio Analysis accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
- Product
- Oracle Project Portfolio Analysis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026WPZOOM Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57712 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Portfolio wpzoom-portfolio allows Reflected XSS.This issue affects WPZOOM Portfolio: from n/a through <= 1.4.29.
- Product
- WPZOOM Portfolio
- Affected
- up to 1.4.29
- What to do
- Affects up to 1.4.29. Update WPZOOM Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 7, 2026The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticateCVE-2026-59708 · Other software · ghostfolio · reported by VulnCheckHigh 8.7
The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticated access to full portfolio data. Attackers with a private access ID can retrieve sensitive portfolio information including holdings, quantities, buy prices, and performance metrics without authentication.
- Product
- ghostfolio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026Ghostfolio's PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint fails to verify Access.permissions field when processing the Impersonation-Id headeCVE-2026-59709 · Other software · Ghostfolio · reported by VulnCheckMedium 5.3
Ghostfolio's PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint fails to verify Access.permissions field when processing the Impersonation-Id header, allowing read-only access grantees to modify portfolio holding tags. Attackers with valid read-only share tokens can assign or remove tags on victim holdings, corrupting portfolio categorization and reports.
- Product
- Ghostfolio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2026Joomla Component Myportfolio 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQLCVE-2017-20280 · Websites & servers · reported by VulnCheckHigh 8.8
Joomla Component Myportfolio 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the pid parameter. Attackers can send GET requests to index.php with malicious pid values in the task=project&view=grid endpoint to extract sensitive database information.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Jun 19, 2026Joomla! Component RPC Responsive Portfolio 1.6.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries CVE-2017-20258 · Websites & servers · reported by VulnCheckHigh 8.8
Joomla! Component RPC Responsive Portfolio 1.6.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=com_pofos&view=pofo&id=[SQL] to extract sensitive database information.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextro.media
Jun 17, 2026Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations).CVE-2026-46962 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in takeover of Oracle Project Portfolio Analysis. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle Project Portfolio Analysis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations).CVE-2026-46961 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in takeover of Oracle Project Portfolio Analysis. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle Project Portfolio Analysis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations).CVE-2026-46960 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.2
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in takeover of Oracle Project Portfolio Analysis. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle Project Portfolio Analysis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026WPZOOM Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-49069 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM Portfolio allows Reflected XSS. This issue affects WPZOOM Portfolio: from n/a through 1.4.21.
- Product
- WPZOOM Portfolio
- Affected
- up to 1.4.21
- What to do
- Affects up to 1.4.21. Update WPZOOM Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 25, 2026Joomla Responsive Portfolio 1.6.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL commands through multipleCVE-2018-25381 · Websites & servers · reported by VulnCheckHigh 7.1
Joomla Responsive Portfolio 1.6.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL commands through multiple filter parameters. Attackers can inject malicious SQL code via the filter_type_id, filter_pid_id, and filter_search parameters in POST requests to extract sensitive database information including credentials and server details.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextro.media
May 10, 2026Filterable Portfolio Gallery 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by enteCVE-2021-47929 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Filterable Portfolio Gallery 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by entering payloads in the title field. Attackers can store JavaScript code like image tags with onerror handlers that execute when the gallery is previewed, affecting all users viewing the page.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordfilterable-portfolio.comwordpress.org
Apr 8, 2026Grand Portfolio: Cross-Site Request Forgery (CSRF)CVE-2026-39634 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Portfolio grandportfolio allows Cross Site Request Forgery.This issue affects Grand Portfolio: from n/a through <= 3.3.
- Product
- Grand Portfolio
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Grand Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Visual Portfolio, Photo Gallery & Post Grid: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-32537 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nK Visual Portfolio, Photo Gallery & Post Grid visual-portfolio allows PHP Local File Inclusion.This issue affects Visual Portfolio, Photo Gallery & Post Grid: from n/a through <= 3.5.1.
- Product
- Visual Portfolio, Photo Gallery & Post Grid
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update Visual Portfolio, Photo Gallery & Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026VW Portfolio: Missing AuthorizationCVE-2026-32437 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vowelweb VW Portfolio vw-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Portfolio: from n/a through <= 1.3.3.
- Product
- VW Portfolio
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update VW Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Perfect Portfolio: Missing AuthorizationCVE-2026-32345 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Perfect Portfolio perfect-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Perfect Portfolio: from n/a through <= 1.2.4.
- Product
- Perfect Portfolio
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Perfect Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 12, 2026NEXULEAN is a cybersecurity portfolio & service platform for an Ethical Hacker, AI Enthusiast, and Penetration Tester.CVE-2026-32138 · Other software · Stalin-143 · reported by GitHubHigh 8.2
NEXULEAN is a cybersecurity portfolio & service platform for an Ethical Hacker, AI Enthusiast, and Penetration Tester. Prior to 2.0.0, a security vulnerability was identified where Firebase and Web3Forms API keys were exposed. An attacker could use these keys to interact with backend services without authentication, potentially leading to unauthorized access to application resources and user data. This vulnerability is fixed in 2.0.0.
- Product
- website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026DesignThemes Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27385 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio designthemes-portfolio allows Reflected XSS.This issue affects DesignThemes Portfolio: from n/a through <= 1.3.
- Product
- DesignThemes Portfolio
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update DesignThemes Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Portfolio Builder: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69375 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SolverWp Portfolio Builder swp-portfolio allows PHP Local File Inclusion.This issue affects Portfolio Builder: from n/a through <= 1.2.5.
- Product
- Portfolio Builder
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Portfolio Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 28, 2026ILIAS Learning Management System 4.3 contains a server-side request forgery vulnerability that allows attackers to read local files through portfolio PDF exportCVE-2020-36944 · Other software · ilias.de · reported by VulnCheckMedium 6.9
ILIAS Learning Management System 4.3 contains a server-side request forgery vulnerability that allows attackers to read local files through portfolio PDF export functionality. Attackers can inject a script that uses XMLHttpRequest to retrieve local file contents when the portfolio is exported to PDF.
- Product
- ILIAS Learning Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jan 22, 2026Ultra Portfolio: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69180 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themepassion Ultra Portfolio ultra-portfolio allows Blind SQL Injection.This issue affects Ultra Portfolio: from n/a through <= 6.7.
- Product
- Ultra Portfolio
- Affected
- up to 6.7
- What to do
- Affects up to 6.7. Update Ultra Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Behance Portfolio Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59135 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
- Product
- Behance Portfolio Manager
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025GS Portfolio for Envato: Missing AuthorizationCVE-2025-62755 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in GS Plugins GS Portfolio for Envato gs-envato-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GS Portfolio for Envato: from n/a through <= 1.4.2.
- Product
- GS Portfolio for Envato
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update GS Portfolio for Envato to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Portfolio Gallery: Missing AuthorizationCVE-2025-62098 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in totalsoft Portfolio Gallery gallery-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Portfolio Gallery: from n/a through <= 1.4.8.
- Product
- Portfolio Gallery
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update Portfolio Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Behance Portfolio Manager: Cross-Site Request Forgery (CSRF)CVE-2025-59137 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
- Product
- Behance Portfolio Manager
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025HomeFix Elementor Portfolio: Missing AuthorizationCVE-2025-68981 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in designthemes HomeFix Elementor Portfolio homefix-ele-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HomeFix Elementor Portfolio: from n/a through <= 1.0.1.
- Product
- HomeFix Elementor Portfolio
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update HomeFix Elementor Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025WeDesignTech Portfolio: Missing AuthorizationCVE-2025-68980 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in designthemes WeDesignTech Portfolio wedesigntech-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Portfolio: from n/a through <= 1.0.2.
- Product
- WeDesignTech Portfolio
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WeDesignTech Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025DesignThemes Portfolio Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68977 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio Addon designthemes-portfolio-addon allows DOM-Based XSS.This issue affects DesignThemes Portfolio Addon: from n/a through <= 1.5.
- Product
- DesignThemes Portfolio Addon
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update DesignThemes Portfolio Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 19, 2025A stored cross-site scripting (XSS) vulnerability exists in the Portfolio feature of the Foxit PDF Editor cloud (pdfonline.foxit.com).CVE-2025-66520 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 6.3
A stored cross-site scripting (XSS) vulnerability exists in the Portfolio feature of the Foxit PDF Editor cloud (pdfonline.foxit.com). User-supplied SVG files are not properly sanitized or validated before being inserted into the HTML structure. As a result, embedded HTML or JavaScript within a crafted SVG may execute whenever the Portfolio file list is rendered.
- Product
- pdfonline.foxit.com
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2025Salient Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68078 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNectar Salient Portfolio salient-portfolio allows Stored XSS.This issue affects Salient Portfolio: from n/a through <= 1.8.2.
- Product
- Salient Portfolio
- Affected
- up to 1.8.2
- What to do
- Affects up to 1.8.2. Update Salient Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Themify Portfolio Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67533 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Portfolio Post themify-portfolio-post allows Stored XSS.This issue affects Themify Portfolio Post: from n/a through <= 1.3.0.
- Product
- Themify Portfolio Post
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Themify Portfolio Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Portfolio and Projects: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67470 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Essential Plugin Portfolio and Projects portfolio-and-projects allows Retrieve Embedded Sensitive Data.This issue affects Portfolio and Projects: from n/a through <= 1.5.5.
- Product
- Portfolio and Projects
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update Portfolio and Projects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2025Social Feed Gallery Portfolio: Stored Cross-Site ScriptingCVE-2025-13896 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Social Feed Gallery Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the [igp-wp] shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Social Feed Gallery Portfolio
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Social Feed Gallery Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 5, 2025Premium Portfolio Features for Phlox: Local File InclusionCVE-2025-12497 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.3.10 via the 'args[extra_template_path]' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
- Product
- Premium Portfolio Features for Phlox
- Affected
- up to 2.3.10
- What to do
- Affects up to 2.3.10. Update Premium Portfolio Features for Phlox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 4, 2025Bootstrap Multi-language Responsive Portfolio: Stored Cross-Site ScriptingCVE-2025-11753 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Bootstrap Multi-language Responsive Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Bootstrap Multi-language Responsive Portfolio
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Bootstrap Multi-language Responsive Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgwordpress.org
Sep 22, 2025Penci Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59586 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Portfolio penci-portfolio allows DOM-Based XSS.This issue affects Penci Portfolio: from n/a through <= 3.5.
- Product
- Penci Portfolio
- Affected
- up to 3.5
- What to do
- Affects up to 3.5. Update Penci Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58245 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bestweblayout Portfolio portfolio allows DOM-Based XSS.This issue affects Portfolio : from n/a through <= 2.58.
- Product
- Portfolio
- Affected
- up to 2.58
- What to do
- Affects up to 2.58. Update Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Advance Portfolio Grid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57982 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBean Advance Portfolio Grid advance-portfolio-grid allows Stored XSS.This issue affects Advance Portfolio Grid: from n/a through <= 1.07.6.
- Product
- Advance Portfolio Grid
- Affected
- up to 1.07.6
- What to do
- Affects up to 1.07.6. Update Advance Portfolio Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Behance Portfolio Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57913 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
- Product
- Behance Portfolio Manager
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2025Responsive Filterable Portfolio: Arbitrary file uploadsCVE-2025-10049 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Responsive Filterable Portfolio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the HdnMediaSelection_image field in all versions up to, and including, 1.0.24. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Responsive Filterable Portfolio
- Affected
- up to 1.0.24
- What to do
- Affects up to 1.0.24. Update Responsive Filterable Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.