[webapps] WordPress Plugin WPZOOM Portfolio 1.4.21 - Reflected Cross-Site Scripting (XSS)

Key Points:

• Main threat/vulnerability/incident: The WPZOOM Portfolio plugin for WordPress (version <= 1.4.21) is vulnerable to reflected Cross-Site Scripting (XSS) due to improper handling of user input in AJAX requests.
• Impact assessment and affected systems: This vulnerability allows unauthenticated attackers to inject arbitrary JavaScript into web pages, potentially leading to session hijacking or other malicious actions when users interact with the affected portfolio items.
• Recommended actions or mitigations: Users should update the WPZOOM Portfolio plugin to the latest version to mitigate this vulnerability and implement input validation measures for AJAX actions.

Technical Details: The vulnerability is identified as CVE-2026-49069. It stems from the wpzoom_load_more_items AJAX action, which lacks proper nonce validation and allows attackers to manipulate HTML attributes through the posts_data parameter.

MITRE ATT&CK Techniques:

• None mentioned

IOCs Mentioned:

• CVE-2026-49069