TI-2026-68003 CVE-2026-42415 · GHSA-4wxh-r8p3-69rq
SQL injection in WordPress Porto Theme Functionality plugin
Priority MEDIUM 46
Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.
Vulnerabilities
8 records
TI-2026-22416 CVE-2026-28075 · GHSA-hxxp-c7gg-4mgr
WordPress Porto theme <= 7.6.2 - Reflected Cross Site Scripting (XSS) vulnerability
Priority LOW 31
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in p-themes Porto porto allows Reflected XSS.This issue affects Porto: from n/a through <= 7.6.2.
TI-2025-39215 CVE-2025-63067 · GHSA-mm38-qj6v-5ph8
WordPress Porto Theme - Functionality plugin < 3.7.3 - Broken Access Control vulnerability
Priority LOW 19
Missing Authorization vulnerability in p-themes Porto Theme - Functionality porto-functionality allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Porto Theme - Functionality: from…
TI-2025-39214 CVE-2025-63066 · GHSA-7wq3-fgh6-wjpx
WordPress Porto Theme - Functionality plugin < 3.7.3 - Cross Site Scripting (XSS) vulnerability
Priority LOW 28
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in p-themes Porto Theme - Functionality porto-functionality allows Stored XSS.This issue affects Porto Theme - Functional…
TI-2024-03552 CVE-2024-3808 · GHSA-6gcr-m3gw-825g
Porto Theme - Functionality <= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode
Priority MEDIUM 42
The Porto Theme - Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.0 via the 'porto_portfolios' shortcode 'portfolio_layout' attribute.
TI-2024-03553 CVE-2024-3809 · GHSA-7643-2fwv-2483
Porto Theme - Functionality <= 3.0.9 - Authenticated (Contributor+) Local File Inclusion via Post Meta
Priority MEDIUM 42
The Porto Theme - Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.9 via the 'slideshow_type' post meta.
TI-2024-03550 CVE-2024-3806 · GHSA-6rv3-q74h-h7v3
Porto <= 7.1.0 - Unauthenticated Local File Inclusion via porto_ajax_posts
Priority MEDIUM 47
The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via the 'porto_ajax_posts' function.
TI-2024-03551 CVE-2024-3807 · GHSA-g78h-6697-3h7r
Porto <= 7.1.0 - Authenticated (Contributor+) Local File Inclusion via Post Meta
Priority MEDIUM 43
The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via 'porto_page_header_shortcode_type', 'slideshow_type' and 'post_layout' post meta.