CVE-2025-68977
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio Addon designthemes-portfolio-addon allows DOM-Based XSS.This issue affects DesignThemes Portfolio Addon: from n/a through <= 1.5.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
DOM-Based XSS vulnerability in DesignThemes Portfolio Addon plugin for WordPress, versions <=1.5, allows attackers to inject malicious scripts.
The DesignThemes Portfolio Addon plugin for WordPress suffers from a DOM-Based Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user input during web page generation [1]. This affects all versions up to and including 1.5.
Exploitation requires a privileged user to perform an action such as clicking a malicious link, visiting a crafted page, or submitting a form, making it a medium-severity issue with a CVSS score of 6.5 [1]. Attackers can leverage this to inject arbitrary JavaScript into the page, which executes when visitors access the site.
Successful attacks can lead to malicious script injection, including redirects, advertisements, and other HTML payloads, potentially compromising the integrity of the website and affecting its visitors [1].
As an immediate action, users should update the plugin to the latest patched version. If unable to do so, consulting with a hosting provider or web developer is advised [1].
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1- Range: <= 1.5
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.