The vulnerability allows an attacker to inject malicious scripts that are reflected back to the victim’s browser when certain input fields in the DesignThemes Portfolio plugin are not properly sanitized. This can lead to session hijacking, defacement, or arbitrary code execution in the context of the affected site.

WordPress sites running the DesignThemes Portfolio plugin version 1.3 or earlier. The product is identified by the designthemes:DesignThemes Portfolio vendor‑product pair. No specific operating‑system or WordPress core versions are mentioned.

The CVSS score of 7.1 rates the vulnerability as high severity. The EPSS score is below 1 %, indicating that the exploitation probability is currently low. The vulnerability is not listed in the CISA KEV catalog. It is likely to be exploited via a crafted URL or form input that the plugin echoes back to the user; the attacker would need to entice a victim to visit the reflected link. No authentication or elevated privileges are required, so the threat is wide.