Wordpress Plugin
CVE-2025-59137
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Cross-Site Request Forgery (CSRF) vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
AnalysisAI
Stored XSS via CSRF in eleopard Behance Portfolio Manager WordPress plugin versions up to 1.7.5 allows authenticated attackers to inject malicious scripts through cross-site request forgery mechanisms, potentially compromising site administrators and visitors. The EPSS score of 0.02% indicates low exploitation probability, though the vulnerability type suggests a chainable attack vector when combined with social engineering. No CVSS score was assigned, limiting quantification of attack complexity and privilege requirements.
Technical ContextAI
This vulnerability combines two distinct vulnerability classes: CWE-352 (Cross-Site Request Forgery) and Stored XSS. The root cause is inadequate CSRF token validation in the eleopard Behance Portfolio Manager plugin, a WordPress plugin that integrates Behance portfolio data into WordPress sites. The vulnerability appears to exist in form handlers or AJAX endpoints that accept portfolio-related data without proper nonce verification or token validation. Because the XSS payload is stored (rather than reflected), it persists in the WordPress database, affecting all subsequent site visitors who view the compromised portfolio content. The Patchstack report confirms this affects the portfolio-manager-powered-by-behance plugin specifically.
Affected ProductsAI
eleopard Behance Portfolio Manager (portfolio-manager-powered-by-behance) versions from an unspecified baseline through version 1.7.5 are affected. This is a WordPress plugin distributed through the official WordPress.org plugin repository. The plugin integrates Behance portfolio functionality into WordPress sites, and all installations running version 1.7.5 or earlier require remediation. The CPE for this plugin would typically be cpe:2.3:a:eleopard:portfolio-manager-powered-by-behance:*:*:*:*:*:wordpress:*:*; however, no specific CPE was provided in the source data. Affected users can identify their installation version via the WordPress Plugins admin panel.
RemediationAI
Update eleopard Behance Portfolio Manager to a version newer than 1.7.5 as released by the vendor. Review Patchstack's vulnerability database entry (https://patchstack.com/database/Wordpress/Plugin/portfolio-manager-powered-by-behance/vulnerability/wordpress-behance-portfolio-manager-plugin-1-7-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve) for the recommended patched version and installation instructions. If automatic updates are not enabled, manually update via WordPress Admin > Plugins > Portfolio Manager Powered by Behance > Update. Additionally, administrators should audit recent portfolio updates in the plugin settings to verify no stored XSS payloads were injected during the window of vulnerability exposure, particularly if the site has been accessed by untrusted users. Consider implementing a Web Application Firewall (WAF) rule to block requests lacking proper WordPress nonces as a temporary mitigation while updates are staged.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today