CVE-2022-0200: Themify Portfolio Post < 1.1.7 - Reflected Cross-Site Scripting

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-02-14 · updated 2026-06-17
Weakness: CWE-79

Description

Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themify_create_popup_page_pagination AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting

Affected products

Themify Portfolio Post: before 1.1.7 — fixed in 1.1.7

How to fix

Upgrade to a fixed version: Themify Portfolio Post 1.1.7. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/bbc0b812-7b30-4ab4-bac8-27c706b3f146
https://wpscan.com/vulnerability/bbc0b812-7b30-4ab4-bac8-27c706b3f146

Get alerted when CVE-2022-0200 or the next vulnerability affects your stack