The vulnerability in the DesignThemes Portfolio Addon plugin arises from improper neutralization of user input during page rendering, enabling a DOM‑based cross‑site scripting flaw. An attacker can inject malicious scripts into the page context, potentially stealing user credentials, hijacking sessions, or defacing site content. This weakness is identified as CWE‑79 and, based on the description, can compromise the confidentiality and integrity of the victim’s browser session.

WordPress sites using the DesignThemes Portfolio Addon plugin from any version through 1.5 are affected. The plugin, supplied by DesignThemes, lacks proper input filtering for content that is displayed within the portfolio interface.

The CVSS score of 6.5 indicates medium severity, but the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via manipulated plugin content or parameters that are rendered client‑side; the exploitation requires a target user to view the vulnerable page and execute injected code in their browser.