# CVE-2026-49069: WPZOOM Portfolio Reflected XSS

Source: https://junglewise.ai/threats/cve-2026-49069-wpzoom-portfolio-reflected-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-49069 · Severity: high · CVSS 7.1 · Published 2026-06-10

WPZOOM Portfolio is a WordPress plugin used to showcase creative work and projects on websites. A security flaw in this plugin allows attackers to trick a site visitor or administrator into clicking a malicious link, which then executes unauthorized code in their browser. This could lead to unauthorized actions being taken on the site, theft of session information, or the display of fraudulent content to users.

Vendors: [WPZOOM](https://junglewise.ai/threats/vendors/wpzoom).

## Quick answers

**Is CVE-2026-49069 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49069 being exploited in the wild.

**How severe is CVE-2026-49069?** High severity, with a CVSS score of 7.1, published 10 June 2026.

**Which products and versions are affected?** WPZOOM Portfolio <= 1.4.21.

**Is there a fix for CVE-2026-49069?** A patch was published on 2026-06-08: Version 1.4.22 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49069 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-49069?** Check whether you run WPZOOM Portfolio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Reflected Cross-Site Scripting (XSS) vulnerability exists in the WPZOOM Portfolio plugin for WordPress (versions <= 1.4.21) due to insufficient sanitization and output encoding of user-supplied input during web page generation. An unauthenticated remote attacker can exploit this by crafting a malicious URL containing JavaScript and tricking a user into interacting with it. Upon execution, the script runs within the context of the victim's browser session, potentially allowing for session hijacking, unauthorized administrative actions, or website defacement. The issue is resolved in version 1.4.22.

## Affected products

- WPZOOM WPZOOM Portfolio <= 1.4.21

## Timeline

- 2026-05-26: other: Reported by Kent Apostol
- 2026-06-08: advisory: Patchstack advisory published
- 2026-06-10: disclosed: NVD publication date
- 2026-06-08: patched: Version 1.4.22 released to address the vulnerability

## References

- [https://patchstack.com/database/wordpress/plugin/wpzoom-portfolio/vulnerability/wordpress-wpzoom-portfolio-plugin-1-4-21-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/wpzoom-portfolio/vulnerability/wordpress-wpzoom-portfolio-plugin-1-4-21-cross-site-scripting-xss-vulnerability?_s_id=cve)

## Related threats

- [WPZOOM Portfolio reflected XSS in WordPress plugin](https://junglewise.ai/threats/cve-2026-57712-wpzoom-portfolio-reflected-xss-in-wordpress-plugin)