WordPress Portfolio Builder – Portfolio Gallery [uber-grid] <= 1.1.7 (unfixed + closed)
unknown
[en] The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'add_video' function in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to add arbitrary videos to any...
- Affected:
- up to 1.1.7
- Fix:
- No patched version reported
- Disclosed:
- Feb 19, 2025
CVE-2024-13231 on NVD →
WordPress Portfolio Builder – Portfolio Gallery <= 1.1.7 - Missing Authorization to Unauthenticated Portfolio Update
medium
The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'add_video' function in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to add arbitrary videos to any portf...
- CVSS:
- 5.3
- Affected:
- up to 1.1.7
- Fix:
- No patched version reported
- Disclosed:
- Feb 18, 2025
CVE-2024-13231 on NVD →
WordPress Portfolio Builder – Portfolio Gallery <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
medium
The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pfhub_portfolio' and 'pfhub_portfolio_portfolio' shortcodes in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping on user supplied attr...
- CVSS:
- 6.4
- Affected:
- up to 1.1.7
- Fix:
- No patched version reported
- Disclosed:
- Feb 18, 2025
CVE-2025-1757 on NVD →
WordPress Portfolio Builder – Portfolio Gallery [uber-grid] <= 1.1.7 (unfixed + closed)
unknown
[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Portfoliohub WordPress Portfolio Builder – Portfolio Gallery allows Stored XSS.This issue affects WordPress Portfolio Builder – Portfolio Gallery: from n/a through 1.1.7.
- Affected:
- up to 1.1.7
- Fix:
- No patched version reported
- Disclosed:
- Nov 30, 2024
CVE-2024-53788 on NVD →
WordPress Portfolio Builder – Portfolio Gallery <= 1.1.7 - Authenticated (Editor+) Stored Cross-Site Scripting
medium
The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access and above, to inject arbi...
- CVSS:
- 4.4
- Affected:
- up to 1.1.7
- Fix:
- No patched version reported
- Disclosed:
- Nov 28, 2024
CVE-2024-53788 on NVD →
WordPress Portfolio Builder – Portfolio Gallery [uber-grid] <= 1.1.7 (unfixed + closed)
unknown
[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Portfoliohub WordPress Portfolio Builder – Portfolio Gallery allows Stored XSS.This issue affects WordPress Portfolio Builder – Portfolio Gallery: from n/a through 1.1.7.
- Affected:
- up to 1.1.7
- Fix:
- No patched version reported
- Disclosed:
- Oct 17, 2024
CVE-2024-49302 on NVD →
WordPress Portfolio Builder – Portfolio Gallery <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...
- CVSS:
- 6.4
- Affected:
- up to 1.1.7
- Fix:
- No patched version reported
- Disclosed:
- Oct 15, 2024
CVE-2024-49302 on NVD →
WordPress Portfolio Builder – Portfolio Gallery [uber-grid] <= 1.1.7 (unfixed + closed)
unknown
The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pfhub_portfolio' and 'pfhub_portfolio_portfolio' shortcodes in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output...
- Affected:
- up to 1.1.7
- Fix:
- No patched version reported
WordPress Portfolio Builder – Portfolio Gallery [uber-grid] <= 1.1.7 (unfixed + closed)
unknown
- Affected:
- up to 1.1.7
- Fix:
- No patched version reported
CVE-2025-1757 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database