CVE-2026-57712: WordPress WPZOOM Portfolio plugin <= 1.4.29 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Portfolio wpzoom-portfolio allows Reflected XSS.This issue affects WPZOOM Portfolio: from n/a through <= 1.4.29.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attack vector is network-based, requires no privileges, and has low complexity. However, user interaction is required, meaning an attacker would need to induce a user to visit or interact with a crafted request or page.
Are installations running version 1.4.29 affected?
Yes. The affected range includes WPZOOM Portfolio versions through and including 1.4.29; no lower bound is specified.
What is the potential impact if exploitation succeeds?
The reported impact includes low confidentiality, integrity, and availability effects. The scope is changed, indicating the vulnerable component can affect resources beyond its own authorization scope.