/Vulnerability Library

WPZOOM Portfolio <= 1.4.21 - Reflected Cross-Site Scripting

CVE-2026-49069
Verified

Description

WPZOOM Portfolio <= 1.4.21 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts in victim's browser, exploit requires crafted request.

Severity

High

CVSS Score

7.1

Exploit Probability

1%

Affected Product

wpzoom-portfolio

Published Date

August 19, 2026

Template Author

aryu-ru

CVE-2026-49069.yaml
7.1Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVE ID:
cve-2026-49069
CWE ID:
cwe-79

References

https://patchstack.com/database/wordpress/plugin/wpzoom-portfolio/vulnerability/wordpress-wpzoom-portfolio-plugin-1-4-21-cross-site-scripting-xss-vulnerability?_s_id=cvehttps://www.exploit-db.com/exploits/52611https://nvd.nist.gov/vuln/detail/CVE-2026-49069

Remediation Steps

Update to the latest version of WPZOOM Portfolio.