PowerFolio – Portfolio & Image Gallery for Elementor <= 3.2.7 - Authenticated (Contributor+) CSS Injection via Gutenberg Block Attributes
- ID
- WPSEC-2026-0380
- Plugin
- PowerFolio – Portfolio & Image Gallery for Elementor (portfolio-elementor)
- Affected
- from 3.0 before 3.2.8
- Remediation
- Update to 3.2.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
- Weakness
- CWE-74
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- PowerFolio – Portfolio & Image Gallery for Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The PowerFolio – Portfolio & Image Gallery for Elementor plugin for WordPress is vulnerable to CSS Injection via the styling attributes of its Portfolio and Image Gallery Gutenberg blocks (bgColor, item_bordercolor, filter_bgcolor, filter_bgcolor_active, text_transform, filter_text_transform and text_align) in versions 3.0 through 3.2.7. This is due to these values being inserted into an inline style element on the front end without validation. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary CSS rules into pages that render the block, which can be used to alter, hide or overlay page content and to make visitors' browsers load external resources. Version 3.2.8 restricts these values to valid colors, keywords and numbers.
References
- https://wpsec.com/vuln/WPSEC-2026-0380/
- https://plugins.svn.wordpress.org/portfolio-elementor/tags/3.2.8/
- https://wordpress.org/plugins/portfolio-elementor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS