CVE-2026-49069 is a reflected XSS vulnerability in WPZOOM Portfolio affecting versions up to and including 1.4.21. The issue is caused by improper input neutralization during web page generation, which can allow an attacker to inject malicious scripts that execute in the context of the victim's browser. The CVSS 3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at a low level. There is no official patch or remediation level provided by the vendor at this time.

Successful exploitation can lead to execution of arbitrary scripts in the victim's browser, potentially resulting in information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability as indicated by the CVSS vector. The vulnerability requires user interaction and can be exploited remotely over the network without privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying workarounds such as input validation or disabling the vulnerable component if feasible. Monitor vendor communications for updates on patches or official mitigations.