What is the CVSS score of CVE-2026-57712?

CVE-2026-57712 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of WPZOOM Portfolio are affected by CVE-2026-57712?

The WPZOOM Portfolio WordPress plugin (versions up to 1.4.29) contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious code executed in administrator and user…

How to fix or mitigate CVE-2026-57712?

Within 24 hours, identify all WordPress installations using WPZOOM Portfolio and disable the plugin immediately as an interim protective measure. Within 7 days, procure an alternative portfolio plugin solution with active security maintenance and plan a controlled migration timeline; simultaneously implement web application firewall (WAF) rules to detect and block XSS injection patterns targeting the plugin endpoints. Within 30 days, complete migration to the alternative plugin and conduct a forensic review of administrator session logs for indicators of unauthorized access or token exfiltration during the vulnerability window.

WPZOOM Portfolio CVE-2026-57712

EUVD-2026-43367 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Wordpress Plugin Wpzoom Portfolio Wpzoom

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated remote reflected XSS delivered via URL requires a victim click (UI:R) and crosses into the browser context (S:C), yielding limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:47 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Portfolio wpzoom-portfolio allows Reflected XSS.This issue affects WPZOOM Portfolio: from n/a through <= 1.4.29.

AnalysisAI

Reflected cross-site scripting in the WPZOOM Portfolio WordPress plugin (all versions up to and including 1.4.29) lets remote attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. Reported by Patchstack with a CVSS 3.1 score of 7.1, the flaw requires user interaction and carries no public exploit identified at time of analysis and no CISA KEV listing. Impact is scoped to the session of whichever user is lured into clicking, including logged-in administrators.

Technical ContextAI

The vulnerability is a classic reflected XSS (CWE-79, Improper Neutralization of Input During Web Page Generation) in a WordPress plugin. WPZOOM Portfolio is a display/gallery plugin (cpe:2.3:a:wpzoom:wpzoom_portfolio) that renders portfolio content on public-facing pages. The root cause is that attacker-controllable request input (a URL/query parameter) is echoed back into an HTML response without proper output encoding or sanitization, so the browser parses injected markup as active script. Because the payload is reflected rather than stored, it must be delivered per-request via a crafted URL and is not persisted server-side.

RemediationAI

No vendor-released patch version is confirmed in the available data; because the flaw affects up to and including 1.4.29, upgrade to the next release above 1.4.29 as published by WPZOOM once available, and consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/wpzoom-portfolio/vulnerability/wordpress-wpzoom-portfolio-plugin-1-4-29-cross-site-scripting-xss-vulnerability) for the exact fixed build. As compensating controls until patched, deploy a Web Application Firewall or Patchstack's virtual patch to filter reflected script payloads on the plugin's endpoints, which may cause false positives on legitimate rich input; add a restrictive Content-Security-Policy that disallows inline script to blunt payload execution, noting it can break themes or plugins relying on inline JS; and if the plugin is not essential, deactivate it to remove the attack surface entirely at the cost of losing portfolio functionality.