CVE-2025-68078

The Salient Portfolio theme for WordPress contains a stored cross-site scripting (XSS) vulnerability due to improper neutralization of user input during web page generation [1]. This affects versions from n/a through 1.8.2. The vulnerability allows attackers to inject arbitrary HTML and JavaScript code that gets executed when other users visit affected pages.

Exploitation requires an authenticated user with elevated privileges (e.g., editor or admin) to interact with a crafted link or form [1]. While the attacker must have some level of access, the stored payload persists and triggers on subsequent visits, potentially affecting site visitors and other administrators.

Successful exploitation could lead to script injection, such as redirects, advertisements, or other malicious payloads, compromising site integrity and user safety [1].

The issue has been addressed in version 1.8.3. Users are strongly advised to update immediately to mitigate the risk [1].