CVE-2026-49069: WordPress WPZOOM Portfolio plugin <= 1.4.21 - Cross Site Scripting (XSS) vulnerability

Q: What is the severity of CVE-2026-49069?

The severity of CVE-2026-49069 is classified as high with a score of 7.1.

Q: How do I fix CVE-2026-49069?

To fix CVE-2026-49069, update the WordPress WPZOOM Portfolio Plugin to version 1.4.22 or later.

Q: What type of vulnerability is CVE-2026-49069?

CVE-2026-49069 is a Cross-Site Scripting (XSS) vulnerability affecting the WPZOOM Portfolio plugin.

Q: What versions of the WPZOOM Portfolio plugin are affected by CVE-2026-49069?

CVE-2026-49069 affects WPZOOM Portfolio plugin versions from n/a through 1.4.21.

Q: What impact does CVE-2026-49069 have on users?

CVE-2026-49069 allows for reflected XSS attacks, potentially compromising user data and security.

Published Jun 10, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM Portfolio allows Reflected XSS.

This issue affects WPZOOM Portfolio: from n/a through 1.4.21.

Affected Software

1 affected component

wordpress/wpzoom-portfolio<=1.4.21

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress WPZOOM Portfolio plugin to a version that resolves this vulnerability.
Fixed in 1.4.22

Event History

Jun 10, 2026

CVE Published

via MITRE·12:39 PM

Data Sourced

via MITRE·12:39 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeakness

Jul 6, 2026

Exploit Published

via ExploitDB·12:00 AM

Known Exploited

03:55 PM

Frequently Asked Questions

What is the severity of CVE-2026-49069?

The severity of CVE-2026-49069 is classified as high with a score of 7.1.

How do I fix CVE-2026-49069?