The vulnerability resides in the WordPress Portfolio Builder – Portfolio Gallery plugin, which fails to sanitize user supplied attributes for the 'pfhub_portfolio' and 'pfhub_portfolio_portfolio' shortcodes. An authenticated user with contributor‑level access or higher can embed malicious scripts into stored content. The injected code is executed in a victim’s browser whenever the affected page is loaded, enabling session hijacking, cookie theft, defacement or other client‑side attacks typical of Cross‑Site Scripting (CWE‑79).

The affected product is PortfolioHub WordPress Portfolio Builder – Portfolio Gallery, versions up to and including 1.1.7. Any installation of these versions that allows contributor‑level users to publish or edit content is vulnerable.

The CVSS score of 6.4 indicates a medium‑to‑high severity, but the EPSS score of less than 1% shows the likelihood of exploitation is low at present. The issue is not listed in the CISA KEV catalog. A necessary prerequisite is authentication as a user with contributor or higher privileges. The attack vector is inbound on the WordPress site; an attacker can inject a malicious payload through the shortcode attributes which is then rendered for all users visiting the page. The lack of input validation and output escaping creates a persistent XSS vector that can be exploited if the user’s role permits shortcode use.