CVE-2026-57712: WordPress WPZOOM Portfolio plugin <= 1.4.29 - Cross Site Scripting (XSS) vulnerability

Q: What must an attacker do to exploit this issue?

The attack vector is network-based, requires no privileges, and has low complexity. However, user interaction is required, meaning an attacker would need to induce a user to visit or interact with a crafted request or page.

Q: Are installations running version 1.4.29 affected?

Yes. The affected range includes WPZOOM Portfolio versions through and including 1.4.29; no lower bound is specified.

Q: What is the potential impact if exploitation succeeds?

The reported impact includes low confidentiality, integrity, and availability effects. The scope is changed, indicating the vulnerable component can affect resources beyond its own authorization scope.

Published Jul 13, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Portfolio wpzoom-portfolio allows Reflected XSS.This issue affects WPZOOM Portfolio: from n/a through <= 1.4.29.

Affected Software

1 affected component

WPZOOM Portfolio<=1.4.29

Event History

Jul 13, 2026

CVE Published

via MITRE·08:41 AM

Data Sourced

via MITRE·08:41 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker do to exploit this issue?

The attack vector is network-based, requires no privileges, and has low complexity. However, user interaction is required, meaning an attacker would need to induce a user to visit or interact with a crafted request or page.

Are installations running version 1.4.29 affected?

Yes. The affected range includes WPZOOM Portfolio versions through and including 1.4.29; no lower bound is specified.

What is the potential impact if exploitation succeeds?

The reported impact includes low confidentiality, integrity, and availability effects. The scope is changed, indicating the vulnerable component can affect resources beyond its own authorization scope.

CVE-2026-57712: WordPress WPZOOM Portfolio plugin <= 1.4.29 - Cross Site Scripting (XSS) vulnerability

Affected Software

Event History

Frequently Asked Questions

What must an attacker do to exploit this issue?

Are installations running version 1.4.29 affected?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

Are installations running version 1.4.29 affected?

What is the potential impact if exploitation succeeds?