Gs Envato Portfolio Vulnerabilities

The GS Portfolio for Envato plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.4.2. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.4.2

Fix:

No patched version reported

Disclosed:

Dec 31, 2025

CVE-2025-62755 on NVD →

The GS Portfolio for Envato plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 1.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor...

CVSS:

6.4

Affected:

up to 1.3.8

Fixed in:

1.4.0

Disclosed:

Jan 30, 2023

CVE-2023-0559 on NVD →