CVE-2022-0200CWE-79

CVE-2022-0200: vulnerability in Themify Portfolio Post

Themify Portfolio Post < 1.1.7 - Reflected Cross-Site Scripting

Published · Updated

Follow this CVE+ Monitor Portfolio Post

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.6%
Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themify_create_popup_page_pagination AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting
Affected products
Unknown · Themify Portfolio Post
Related CVEs — Themify Portfolio Post

In the same product, most dangerous first.

CVE-2021-24129—Themify Portfolio Post < 1.1.6 - Authenticated Stored Cross-Site ScriptingEPSS 0.7%CVE-2022-4464MEDIUMThemify Portfolio Post < 1.2.1 - Contributor+ Stored XSSEPSS 0.5%CVE-2023-0362MEDIUMThemify Portfolio Post < 1.2.2 - Contributor+ Stored XSSEPSS 0.5%