The plugin processes user supplied content without proper output encoding, allowing stored XSS. An attacker can insert malicious scripts that persist in the database and will run in the browsers of any visitor who views the affected pages, enabling data theft, account hijacking, or site defacement.

Themifyme’s Themify Portfolio Post WordPress plugin versions up to and including 1.3.0 are vulnerable. Any deployment of the plugin that has not been upgraded beyond 1.3.0 carries the risk.

The vulnerability has a CVSS score of 7.1 and an EPSS score below 1 %. It is not listed in the CISA KEV catalog. Exploit requires a web‑based interface where an attacker can submit malicious content; the attack vector is likely through form submissions within the plugin. Successful exploitation can compromise confidentiality and integrity of the target site’s users.