Reflected XSS in WPZOOM Portfolio Plugin Versions

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM Portfolio allows Reflected XSS. This issue affects WPZOOM Portfolio: from n/a through 1.4.21.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

WPZOOM Portfolio contains a reflected Cross-Site Scripting (XSS) vulnerability affecting versions up to 1.4.21. This CWE-79 flaw allows attackers to inject malicious scripts into web pages during generation, enabling them to steal user sessions, credentials, and sensitive data. WordPress site administrators using this popular portfolio plugin are at immediate risk, particularly if they haven't patched to a version beyond 1.4.21. The reflected nature of this XSS means attackers can craft malicious links and trick users into clicking them, making social engineering a key attack vector.

Casky's 301 matching security skills leverage Claude AI's extended reasoning to map this vulnerability against MITRE ATT&CK Initial Access (TA0001) and Execution (TA0043) techniques. Practitioners using Casky would see detailed findings showing how reflected XSS enables attackers to establish initial footholds through social engineering and credential theft, then execute arbitrary code in user browsers. The platform's skills would identify attack chains where an attacker crafts a malicious URL, delivers it via phishing (TA0001), and upon click, executes JavaScript in the victim's session (TA0043). Your security team gains visibility into payload patterns, input vectors requiring sanitization, and the specific plugin code paths vulnerable to exploitation—enabling proactive detection rules and prioritized patching strategies.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-49069.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-49069

Casky has 301 skills that investigate the attack patterns behind CVE-2026-49069. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn