plugin

Otw Portfolio Manager Vulnerabilities

2 known security issues reported for the Otw Portfolio Manager WordPress plugin. Most recent disclosed Aug 21, 2025.

1 critical 1 high

Running Otw Portfolio Manager on your site? Check whether your installed version is affected.

Scan your site free

Portfolio Manager Pro 3.8 - Unauthenticated Arbitrary File Upload

critical

The Portfolio Manager Pro - WordPress Responsive Portfolio & Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in version 3.8. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code ex...

CVSS:
9.8
Affected:
3.8 – 3.8
Fix:
No patched version reported
Disclosed:
Aug 21, 2025

CVE-2025-49410 on NVD →

Portfolio Manager Pro 3.8 - Unauthenticated PHP Object Injection

high

The Portfolio Manager Pro plugin for WordPress is vulnerable to PHP Object Injection in versions up to 3.8 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an addit...

CVSS:
8.1
Affected:
3.8 – 3.8
Fix:
No patched version reported
Disclosed:
Aug 21, 2025

CVE-2025-49409 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database