Tlp Portfolio Vulnerabilities

[en] Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in RadiusTheme Portfolio – WordPress Portfolio plugin <= 2.8.10 versions.

Affected:

up to 2.8.11

Fixed in:

2.8.11

Disclosed:

Apr 4, 2023

CVE-2023-23685 on NVD →

The Portfolio – WordPress Portfolio Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcode attributes in versions up to, and including, 2.8.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level p...

CVSS:

6.4

Affected:

up to 2.8.10

Fixed in:

2.8.11

Disclosed:

Feb 13, 2023

CVE-2023-23685 on NVD →

The Portfolio – WordPress Portfolio Plugin plugin is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.8. This is due to missing or incorrect nonce validation on the rtport_spare_me function. This makes it possible for unauthenticated attackers to dismiss plugin notifications via a forged r...

CVSS:

4.3

Affected:

up to 2.8.8

Fixed in:

2.8.9

Disclosed:

Dec 15, 2022

The Portfolio – WordPress Portfolio Plugin plugin is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.8. This is due to missing or incorrect nonce validation on the rtport_spare_me function. This makes it possible for unauthenticated attackers to dismiss plugin notifications via a forged r...

Affected:

up to 2.8.9

Fixed in:

2.8.9

Disclosed:

Dec 15, 2022