CVE-2024-11900

Summary

CVE-2024-11900: The Portfolio – Filterable Masonry Portfolio Gallery for Professionals plugin for WordPress contains a Stored Cross-Site Scripting vulnerability. This issue affects all versions up to and including 1.2.2. Attackers with contributor-level access or higher can exploit this vulnerability by injecting malicious scripts via the 'portfolio-pro' shortcode's insufficiently sanitized user-supplied attributes. These scripts execute when a user accesses an injected page, posing a significant security risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.