Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-54083 | The Portfolio and Projects plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. |
No reference.
Fri, 09 May 2025 18:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-79 | |
| CPEs | ||
| Vendors & Products |
Essentialplugin
Essentialplugin portfolio And Projects |
|
| References |
|
|
| Metrics |
cvssV3_1
|
Fri, 09 May 2025 18:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Portfolio and Projects <= 1.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting | |
| Metrics |
ssvc
|
Fri, 09 May 2025 17:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Portfolio and Projects plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. | ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage. |
Fri, 28 Mar 2025 13:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Essentialplugin
Essentialplugin portfolio And Projects |
|
| CPEs | cpe:2.3:a:essentialplugin:portfolio_and_projects:*:*:*:*:*:wordpress:*:* | |
| Vendors & Products |
Essentialplugin
Essentialplugin portfolio And Projects |
Mon, 17 Mar 2025 22:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Sat, 15 Mar 2025 03:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Portfolio and Projects plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. | |
| Title | Portfolio and Projects <= 1.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting | |
| Weaknesses | CWE-79 | |
| References |
|
|
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: REJECTED
Assigner: Wordfence
Published:
Updated: 2025-05-09T17:33:11.742Z
Reserved: 2025-02-06T23:15:57.847Z
Link: CVE-2024-13847
Vulnrichment
Updated:
NVD
Status : Rejected
Published: 2025-03-15T04:15:20.473
Modified: 2025-05-09T18:15:36.303
Link: CVE-2024-13847
Redhat
No data.
OpenCVE Enrichment
No data.
No weakness.