CVE-2026-49069: WordPress WPZOOM Portfolio plugin <= 1.4.21 - Cross Site Scripting (XSS) vulnerability

Synopsis

Reflected cross-site scripting (XSS) in the WPZOOM Portfolio WordPress plugin (versions 1.4.21 and earlier) allows an unauthenticated remote attacker to inject malicious JavaScript into a victim's browser by tricking them into clicking a crafted link. The vulnerability is reachable over the network without any login credentials, but requires the victim to follow an attacker-controlled URL. Successful exploitation lets the attacker execute arbitrary scripts in the victim's browser session, enabling session hijacking, credential theft, or unauthorized actions taken on behalf of the victim. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so the attacker must be able to reach the target web server via HTTP or HTTPS.

• AuthenticationNot required

  No account or session credential is needed; the attacker can deliver the malicious payload as an anonymous visitor.

• Victim interactionRequired

  The attack is reflected (not stored), so the victim must click or follow a crafted URL supplied by the attacker for the payload to execute.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable - no race conditions or special environmental configuration are needed beyond delivering the malicious link to the victim.

Blast Radius

• Attacker executes arbitrary JavaScript in the authenticated victim's browser session, enabling theft of session cookies and authentication tokens.
• Attacker can read or exfiltrate page content visible to the victim, including any sensitive data rendered in the WordPress admin or front-end context.
• Attacker can perform actions on the WordPress site on the victim's behalf, such as modifying settings or publishing content, if the victim holds sufficient privileges.
• The affected service itself experiences limited availability impact, consistent with the CVSS A:L rating, such as partial disruption of the page rendering experience for the targeted user.