An attacker can inject malicious script that is stored and then served to any user who views the vulnerable content. The script runs in the victim’s browser context, potentially exposing session cookies, performing phishing, or loading additional malware. The vulnerability is a classic stored XSS (CWE‑79).

ThemeNectar Salient Portfolio theme for WordPress, versions from unversioned releases up to and including 1.8.2 are affected. Earlier versions lack explicit numbering in the CNA data.

The CVSS score of 6.5 indicates a medium severity. An EPSS score of under 1% shows that, at present, the exploitation probability is low but not zero. The vulnerability is not listed in the CISA KEV catalog. The likely attack path involves an attacker who can create or edit portfolio items, entering a payload that is stored in the database and later rendered in a web page. The exposure is limited to browsers rendering the malicious content, but the effect can reach many users who view the affected portfolio items.