The Bootstrap Multi‑language Responsive Portfolio plugin contains a stored cross‑site scripting flaw that allows attackers who are authenticated with administrator‑level permissions or higher to insert arbitrary web scripts through the plugin’s admin settings. When a page that contains the injected content is viewed by a user, the script executes in the victim’s browser, potentially allowing the attacker to manipulate page content and to read or alter data in the victim’s context.

All releases of the Bootstrap Multi‑language Responsive Portfolio plugin up to and including version 1.0 are affected. The vulnerability only applies to WordPress installations that are configured as multisite and that have the unfiltered_html capability disabled. Affected systems are those using the August Infotech plugin in these configurations.

The vulnerability carries a CVSS score of 4.4, indicating moderate severity, and an EPSS score of less than 1 %, representing a low but non‑zero likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. An attacker must have authenticated administrator access to the plugin’s settings to exploit the issue, making the attack path local to the WordPress installation and typically a moderate‑risk scenario with low exploitation probability.