WPZOOM Portfolio CVE-2026-49069

Exploitation requires the target WordPress site to have the WPZOOM Portfolio plugin installed and active at version 1.4.21 or earlier, and requires victim user interaction (UI:R) - specifically, a user must click an attacker-crafted link or submit an attacker-controlled form pointing at a vulnerable plugin endpoint. No authentication is required of the attacker (PR:N), but maximum impact is achieved when the victim is an authenticated WordPress administrator, since the reflected payload executes in their session context. Limiting factors include the need for social engineering to deliver the payload, browser-side XSS protections (CSP, SameSite cookies), and the fact that sites not using this specific plugin are unaffected.

The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects network-reachable, low-complexity exploitation with no authentication required, but explicitly requires user interaction (UI:R) - a victim must click a crafted link. The Changed scope (S:C) elevates the score because XSS in a WordPress front-end can pivot into the authenticated admin session, which is a realistic concern for any logged-in administrator who visits a malicious link. There is no EPSS score, KEV listing, or public POC provided in the intelligence, so this should be treated as no public exploit identified at time of analysis and likely a lower-priority issue than wormable or auth-bypass flaws - but still patch-worthy for any site using the plugin, particularly multi-author WordPress installations. The CVSS vector and Patchstack-reported description are internally consistent; no conflicting signals were observed.

An attacker crafts a URL pointing to a WordPress site running WPZOOM Portfolio ≤ 1.4.21, embedding malicious JavaScript in a vulnerable parameter, and sends it to a logged-in site administrator via phishing email or a social media link. When the admin clicks the link, the reflected payload executes in their browser session, allowing the attacker to steal authentication cookies, perform CSRF-style admin actions (e.g., create a new admin account or inject a malicious plugin), or pivot to a full site takeover. No public POC is referenced in the available intelligence.