CVE-2025-7046
Last modified
CVE-2025-7046 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. The Portfolio for Elementor & Image Gallery | PowerFolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS Attributes of Plugin's widgets in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue was partially fixed in version 3.2.0 and fully fixed in version 3.2.1. EPSS estimates a 0.22% chance of exploitation in the next 30 days.
Description
The Portfolio for Elementor & Image Gallery | PowerFolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS Attributes of Plugin's widgets in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue was partially fixed in version 3.2.0 and fully fixed in version 3.2.1
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Pwrplugins | Powerfolio | < 3.2.1 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-7046?
How severe is CVE-2025-7046?
How do I fix CVE-2025-7046?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-7042Use After Free vulnerability exists in the IPT file reading …7.8
- CVE-2025-70420Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
- CVE-2025-7044An Improper Input Validation vulnerability exists in the use…6.5
- CVE-2025-7045The Cloud SAML SSO plugin for WordPress is vulnerable to Ide…6.5
- CVE-2025-70457A Remote Code Execution (RCE) vulnerability exists in Source…9.8
- CVE-2025-70458A DOM-based Cross-Site Scripting (XSS) vulnerability exists …5.4
- CVE-2025-7047Missing Authorization vulnerability in Utarit Informatics Se…5.4
- CVE-2025-7048On affected platforms running Arista EOS with MACsec configu…5.3
- CVE-2025-7049The WPGYM - Wordpress Gym Management System plugin for WordP…8.8
- CVE-2025-7050The Use-your-Drive | Google Drive plugin for WordPress plugi…7.2
- CVE-2025-7051On N-central, it is possible for any authenticated user to r…8.3
- CVE-2025-7052The LatePoint plugin for WordPress is vulnerable to Cross-Si…8.8
Are you affected by CVE-2025-7046?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST