GCVE - cpe:2.3:a:presstigers:simple_folio:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:presstigers:simple_folio:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Presstigers (`1cb21d96-6088-5991-8415-d9f9b208dc72`)
Product	Simple Folio (`4390950b-7de1-5588-ad9c-f3f062d6a74c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-64256`	vulnerable	2026-06-08 07:39:18.280328	WordPress Simple Folio plugin <= 1.1.0 - Cross Site Request Forgery (CSRF) vulnerability MEDIUM (4.3) Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Folio simple-folio allows Cross Site Request Forgery.This issue affects Simple Folio: from n/a through <= 1.1.0. Published: 2025-12-09T14:13:52.351Z Updated: 2026-04-28T16:14:12.692Z Open on db.gcve.eu Reference links https://patchstack.com/database/Wordpress/Plugin/simple-folio/vulnerability/wordpress-simple-folio-plugin-1-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-14039`	vulnerable	2026-06-08 07:06:33.449470	Simple Folio <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Client name' and 'Link' Meta Fields MEDIUM (6.4) The Simple Folio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_simple_folio_item_client_name' and '_simple_folio_item_link' meta fields in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Published: 2026-01-28T06:43:44.697Z Updated: 2026-04-08T17:20:20.381Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/c32a71d6-d61c-4f6f-9d35-70140235af7c?source=cve https://plugins.trac.wordpress.org/browser/simple-folio/trunk/templates/single-simple-folio.php#L70 https://plugins.trac.wordpress.org/browser/simple-folio/tags/1.1.1/templates/single-simple-folio.php#L70 https://plugins.trac.wordpress.org/browser/simple-folio/trunk/templates/single-simple-folio.php#L76 https://plugins.trac.wordpress.org/browser/simple-folio/tags/1.1.1/templates/single-simple-folio.php#L76	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-12151`	vulnerable	2026-06-08 07:04:29.763733	Simple Folio <= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting MEDIUM (6.4) The Simple Folio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'portfolio_name' parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Published: 2025-11-27T04:36:44.478Z Updated: 2026-04-08T16:55:37.691Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/5c7b9827-59a7-4a8f-88d5-0b27c3ea2925?source=cve https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3401878%40simple-folio&new=3401878%40simple-folio&sfp_email=&sfph_mail=	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.