P-THEMES

Records8All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high4CVSS 7.0–8.9

Exploited now

P-THEMES records in CISA KEV

No P-THEMES vulnerabilities are listed in CISA KEV.

Records

8 records

TI-2024-03550 CVE-2024-3806 · GHSA-6rv3-q74h-h7v3

Porto <= 7.1.0 - Unauthenticated Local File Inclusion via porto_ajax_posts

MEDIUM 47

The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via the 'porto_ajax_posts' function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02687 Published 2024-05-09 No fix listed CWE-98

TI-2026-68003 CVE-2026-42415 · GHSA-4wxh-r8p3-69rq

SQL injection in WordPress Porto Theme Functionality plugin

MEDIUM 46

Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00243 Published 2026-10-06 No fix listed CWE-89

TI-2024-03551 CVE-2024-3807 · GHSA-g78h-6697-3h7r

Porto <= 7.1.0 - Authenticated (Contributor+) Local File Inclusion via Post Meta

MEDIUM 43

The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via 'porto_page_header_shortcode_type', 'slideshow_type' and 'post_layout' post meta.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01538 Published 2024-05-09 No fix listed CWE-98

TI-2024-03553 CVE-2024-3809 · GHSA-7643-2fwv-2483

Porto Theme - Functionality <= 3.0.9 - Authenticated (Contributor+) Local File Inclusion via Post Meta

MEDIUM 42

The Porto Theme - Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.9 via the 'slideshow_type' post meta.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01002 Published 2024-05-09 No fix listed CWE-98

TI-2024-03552 CVE-2024-3808 · GHSA-6gcr-m3gw-825g

Porto Theme - Functionality <= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode

MEDIUM 42

The Porto Theme - Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.0 via the 'porto_portfolios' shortcode 'portfolio_layout' attribute.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01002 Published 2024-05-09 No fix listed CWE-98

TI-2026-22416 CVE-2026-28075 · GHSA-hxxp-c7gg-4mgr

WordPress Porto theme <= 7.6.2 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in p-themes Porto porto allows Reflected XSS.This issue affects Porto: from n/a through <= 7.6.2.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00214 Published 2026-03-05 No fix listed CWE-79

TI-2025-39214 CVE-2025-63066 · GHSA-7wq3-fgh6-wjpx

WordPress Porto Theme - Functionality plugin < 3.7.3 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in p-themes Porto Theme - Functionality porto-functionality allows Stored XSS.This issue affects Porto Theme - Functional…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00232 Published 2025-12-09 No fix listed CWE-79

TI-2025-39215 CVE-2025-63067 · GHSA-mm38-qj6v-5ph8

WordPress Porto Theme - Functionality plugin < 3.7.3 - Broken Access Control vulnerability

LOW 19

Missing Authorization vulnerability in p-themes Porto Theme - Functionality porto-functionality allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Porto Theme - Functionality: from…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0022 Published 2025-12-09 No fix listed CWE-862

Open these records in search →

Critical	2
High	4
Medium	2
Low	0
No CVSS	0