GridKit Portfolio < 2.1.0 - Subscriber+ Stored Cross-Site Scripting
Vulnerability Description
The Portfolio Gallery, Product Catalog WordPress plugin before 2.1.0 does not have authorisation and CSRF checks in various functions related to AJAX actions, allowing any authenticated users, such as subscriber, to call them. Due to the lack of sanitisation and escaping, it could also allows attackers to perform Cross-Site Scripting attacks on pages where a Portfolio is embed
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-25090
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Krzysztof Zając
More from Unknown
View All →Affected Vendor
Unknown
View all reports →