Stored XSS Vulnerability in Easy Portfolio by Tushar Patel
CVE-2025-23796

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Easy Portfolio
Vendor
CVE Published:
16 January 2025

What is CVE-2025-23796?

A vulnerability has been identified in the Easy Portfolio plugin for WordPress, which allows for stored Cross-site Scripting (XSS) attacks. This issue arises from improper neutralization of user input during web page generation. Attackers can exploit this vulnerability by injecting malicious scripts into web pages, leading to potential data theft and unauthorized actions on behalf of users. The affected versions range from n/a to 1.3, highlighting the importance of updating to mitigate risks.

Affected Version(s)

Easy Portfolio <= 1.3

References

https://patchstack.com/database/wordpress/plugin/easy-por...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SOPROBRO (Patchstack Alliance)
.