Stored Cross-Site Scripting in PowerFolio Plugin for WordPress

CVE-2025-7046

What is CVE-2025-7046?

The PowerFolio plugin for WordPress has a vulnerability that allows authenticated users with Contributor-level access and above to perform Stored Cross-Site Scripting (XSS) attacks. This issue arises from inadequate input sanitization and output escaping in the Custom JS Attributes for the plugin’s widgets. As a result, attackers can inject malicious web scripts into pages, executing those scripts whenever another user accesses the affected page. Although this vulnerability was partially addressed in version 3.2.0, it was fully resolved in version 3.2.1.

References