CVE-2025-59137
Lifecycle Timeline
2Description
Cross-Site Request Forgery (CSRF) vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
Analysis
Stored XSS via CSRF in eleopard Behance Portfolio Manager WordPress plugin versions up to 1.7.5 allows authenticated attackers to inject malicious scripts through cross-site request forgery mechanisms, potentially compromising site administrators and visitors. The EPSS score of 0.02% indicates low exploitation probability, though the vulnerability type suggests a chainable attack vector when combined with social engineering. No CVSS score was assigned, limiting quantification of attack complexity and privilege requirements.
Technical Context
This vulnerability combines two distinct vulnerability classes: CWE-352 (Cross-Site Request Forgery) and Stored XSS. The root cause is inadequate CSRF token validation in the eleopard Behance Portfolio Manager plugin, a WordPress plugin that integrates Behance portfolio data into WordPress sites. The vulnerability appears to exist in form handlers or AJAX endpoints that accept portfolio-related data without proper nonce verification or token validation. Because the XSS payload is stored (rather than reflected), it persists in the WordPress database, affecting all subsequent site visitors who view the compromised portfolio content. The Patchstack report confirms this affects the portfolio-manager-powered-by-behance plugin specifically.
Affected Products
eleopard Behance Portfolio Manager (portfolio-manager-powered-by-behance) versions from an unspecified baseline through version 1.7.5 are affected. This is a WordPress plugin distributed through the official WordPress.org plugin repository. The plugin integrates Behance portfolio functionality into WordPress sites, and all installations running version 1.7.5 or earlier require remediation. The CPE for this plugin would typically be cpe:2.3:a:eleopard:portfolio-manager-powered-by-behance:*:*:*:*:*:wordpress:*:*; however, no specific CPE was provided in the source data. Affected users can identify their installation version via the WordPress Plugins admin panel.
Remediation
Update eleopard Behance Portfolio Manager to a version newer than 1.7.5 as released by the vendor. Review Patchstack's vulnerability database entry (https://patchstack.com/database/Wordpress/Plugin/portfolio-manager-powered-by-behance/vulnerability/wordpress-behance-portfolio-manager-plugin-1-7-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve) for the recommended patched version and installation instructions. If automatic updates are not enabled, manually update via WordPress Admin > Plugins > Portfolio Manager Powered by Behance > Update. Additionally, administrators should audit recent portfolio updates in the plugin settings to verify no stored XSS payloads were injected during the window of vulnerability exposure, particularly if the site has been accessed by untrusted users. Consider implementing a Web Application Firewall (WAF) rule to block requests lacking proper WordPress nonces as a temporary mitigation while updates are staged.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today