Stored Cross-Site Scripting in PowerFolio Plugin for WordPress

CVE-2025-7046

What is CVE-2025-7046?

The PowerFolio plugin for WordPress has a vulnerability that allows authenticated users with Contributor-level access and above to perform Stored Cross-Site Scripting (XSS) attacks. This issue arises from inadequate input sanitization and output escaping in the Custom JS Attributes for the plugin’s widgets. As a result, attackers can inject malicious web scripts into pages, executing those scripts whenever another user accesses the affected page. Although this vulnerability was partially addressed in version 3.2.0, it was fully resolved in version 3.2.1.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References