The Simple Folio WordPress plugin is vulnerable to a stored cross-site scripting flaw that allows authenticated users with subscriber-level or higher access to inject arbitrary JavaScript into the portfolio_name field. When a malicious user manipulates this field, the attacker‑supplied script is stored and rendered whenever a user loads the affected page. Potential consequences such as defacement, cookie theft, or credential hijacking are inferred from the nature of XSS attacks, but the CVE description does not explicitly state these outcomes.

All releases of the Simple Folio plugin from Presstigers up to and including version 1.1.0 are affected. Sites running any of these unpatched versions with subscribers or elevated roles that can edit portfolio names are at risk.

The CVSS score of 6.4 indicates moderate severity. An EPSS score of less than 1% suggests that exploitation is rare, and the vulnerability is not listed in the CISA KEV catalog. Attackers must first obtain authenticated credentials with subscriber or higher privileges, then submit a malicious payload via the portfolio_name field; because the flaw is stored, the malicious code remains until the content is removed, affecting all users who view the page.