The vulnerability in WPBean’s Advance Portfolio Grid plugin allows attackers to store malicious JavaScript through improper input neutralization. When the compromised content is later rendered, the code executes in the browsers of any user who views the affected portfolio item. This can lead to session hijacking, defacement, data exfiltration, or delivery of malware to site visitors.

All releases of the Advance Portfolio Grid plugin for WordPress up to and including version 1.07.6 are affected. The issue originates in the plugin’s content serialization and rendering components, which fail to escape or sanitize stored user input.

The flaw carries a CVSS score of 5.9, placing it in the moderate severity range. Its EPSS score of less than 1% indicates a low current likelihood of exploitation, and it is not listed in the CISA KEV catalog. The attack vector is likely through authenticated content editors or users with permission to submit portfolio items. Once injected, the malicious script remains in the database and impacts all visitors who access the affected entry.