WordPress Plugin WPZOOM Portfolio 1.4.21 - Reflected Cross-Site Scripting (XSS)

ExploitDBExploitDB exploitScannerEDB-52611

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact describes a reflected XSS vulnerability in WPZOOM Portfolio and provides a Proof of Concept (PoC) that demonstrates how to trigger the vulnerability. The PoC sends a crafted POST request and instructs the user to review the HTTP response for injected attributes, which is a detection/validation step. It does not include code to automatically deliver the payload to a victim's browser or execute the JavaScript, thus it functions as a scanner that validates the vulnerability's presence rather than an exploit that exercises it.

Backdoor review

No backdoor observed in reviewed code

The supplied text describes a reflected XSS vulnerability in the WPZOOM Portfolio plugin. The PoC demonstrates how an attacker can inject a JavaScript event handler via the 'class' parameter. The payload shown ('onmouseover=alert(document.domain)') is a standard XSS proof-of-concept that executes in the victim's browser context to demonstrate the vulnerability. There is no evidence of concealed executable behavior, persistence, credential theft, or any operator-directed harm beyond the stated XSS demonstration.

ClassificationScanner
Model confidence95%
AuthenticationNot required
Languagestext
Target softwareWPZOOM Portfolio
Attack typescross-site-scripting-xss
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact provides a PoC that sends a request and relies on manual review of the response to confirm the vulnerability. It does not include code to deliver the payload to a victim or automatically execute the JavaScript, which is characteristic of a scanner that detects/validates the vulnerability rather than an exploit that exercises it.

exploits/multiple/webapps/52611.txt:17-33

Requirements

  • Target must have WPZOOM Portfolio plugin version <= 1.4.21 installed and at least one published portfolio item.exploits/multiple/webapps/52611.txt:11-15

Observed behavior

  • Sends a POST request to /wp-admin/admin-ajax.php with action=wpzoom_load_more_items and a crafted posts_data parameter containing a single quote to break out of an HTML attribute.exploits/multiple/webapps/52611.txt:20-25
  • Instructs the user to manually review the HTTP response to verify that the injected single quote and event handler are reflected in the HTML without proper escaping.exploits/multiple/webapps/52611.txt:28-30
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Xss Payload
x' onmouseover='alert(document.domain)' y='Standard XSS PoC payload demonstrating script injection via HTML attribute breakoutexploits/multiple/webapps/52611.txt:25
Review boundaries

What the analysis did not establish

  • The artifact is a text writeup with an embedded PoC request; no executable code is provided.
  • The PoC requires manual review of the HTTP response to confirm the vulnerability, which is a detection step rather than automated exploitation.
  • Only the supplied text file was reviewed; no external resources, tools, or libraries were analyzed
  • The actual exploitability depends on the target WordPress installation and plugin version, which were not verified
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1