Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions prior to 1.1.6, lead to Stored Cross-Site Scripting (XSS) vulnerabilities allowing low-privileged users (Contributor+) to inject arbitrary JavaScript code or HTML in posts where the Themify Custom Panel is embedded, which could lead to privilege escalation.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
themify portfolio post |
Vulmon