https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2014-125109.htmlhttps://patchthecve.com/cve/CVE-2014-125109.htmlWed, 17 Jun 2026 00:04:28 +0000LOW 3.5: A vulnerability was found in BestWebSoft Portfolio Plugin up to 2.27. It has been declared as problematic. This vulnerability affects the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack can behttps://patchthecve.com/cve/CVE-2012-10017.htmlhttps://patchthecve.com/cve/CVE-2012-10017.htmlTue, 16 Jun 2026 23:38:40 +0000MEDIUM 4.3: A vulnerability was found in BestWebSoft Portfolio Plugin up to 2.04 on WordPress. It has been classified as problematic. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 2.06 is able to address thttps://patchthecve.com/cve/CVE-2023-23685.htmlhttps://patchthecve.com/cve/CVE-2023-23685.htmlWed, 17 Jun 2026 05:37:43 +0000MEDIUM 6.5: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in RadiusTheme Portfolio – WordPress Portfolio plugin <= 2.8.10 versions.https://patchthecve.com/cve/CVE-2022-24255.htmlhttps://patchthecve.com/cve/CVE-2022-24255.htmlThu, 09 Jul 2026 01:17:17 +0000HIGH 8.8: Extensis Portfolio v4.0 was discovered to contain hardcoded credentials which allows attackers to gain administrator privileges.https://patchthecve.com/cve/CVE-2022-24254.htmlhttps://patchthecve.com/cve/CVE-2022-24254.htmlThu, 09 Jul 2026 01:17:17 +0000HIGH 8.8: An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted ZIP file.https://patchthecve.com/cve/CVE-2022-24253.htmlhttps://patchthecve.com/cve/CVE-2022-24253.htmlThu, 09 Jul 2026 01:17:17 +0000HIGH 8.8: Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the component AdminFileTransferServlet.https://patchthecve.com/cve/CVE-2022-24252.htmlhttps://patchthecve.com/cve/CVE-2022-24252.htmlThu, 09 Jul 2026 01:17:16 +0000HIGH 8.8: An unrestricted file upload vulnerability in the FileTransferServlet component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted file.https://patchthecve.com/cve/CVE-2022-24251.htmlhttps://patchthecve.com/cve/CVE-2022-24251.htmlThu, 09 Jul 2026 01:17:16 +0000HIGH 8.8: Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the Catalog Asset Upload function.https://patchthecve.com/cve/CVE-2018-18087.htmlhttps://patchthecve.com/cve/CVE-2018-18087.htmlWed, 17 Jun 2026 01:46:45 +0000MEDIUM 5.4: The Bixie Portfolio plugin 1.2.0 for Pagekit has XSS: a logged-in user who has the "Manage portfolio" privilege can inject arbitrary web script or HTML via the Image URL field in the portfolio editor. The vulnerability is triggered by visiting /portfolio/${project_title}.