WordPress plugin
Porto Theme - Functionality security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical1
- High3
- Medium3
- Low0
All Porto Theme - Functionality vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.5 | Functionality <= 3.9.3 - Unauthenticated SQL Injection ≤3.9.3No patch available | CVE-2026-42415 | |
| Medium4.3 | Functionality < 3.7.3 - Missing Authorization <3.7.3Update to 3.7.3 | CVE-2025-63067 | |
| Medium6.4 | Functionality < 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting <3.7.3Update to 3.7.3 | CVE-2025-63066 | |
| High8.8 | Functionality <= 3.0.9 - Authenticated (Contributor+) Local File Inclusion via Post Meta ≤3.0.9Update to 3.1.0 | CVE-2024-3809 | |
| High8.8 | Functionality <= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode ≤3.1.0Update to 3.1.1 | CVE-2024-3808 | |
| Medium5.3 | Functionality <= 2.11.1 - Missing Authorization ≤2.11.1Update to 2.12.1 | CVE-2023-48739 | |
| Critical9.8 | Functionality <= 2.11.1 - Unauthenticated SQL Injection ≤2.11.1Update to 2.12.1 | CVE-2023-48738 |
- High7.5Functionality <= 3.9.3 - Unauthenticated SQL Injection
≤3.9.3No patch available
- Medium4.3Functionality < 3.7.3 - Missing Authorization
<3.7.3Update to 3.7.3
- Medium6.4Functionality < 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
<3.7.3Update to 3.7.3
- High8.8Functionality <= 3.0.9 - Authenticated (Contributor+) Local File Inclusion via Post Meta
≤3.0.9Update to 3.1.0
- High8.8Functionality <= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode
≤3.1.0Update to 3.1.1
- Medium5.3Functionality <= 2.11.1 - Missing Authorization
≤2.11.1Update to 2.12.1
- Critical9.8Functionality <= 2.11.1 - Unauthenticated SQL Injection
≤2.11.1Update to 2.12.1
Porto Theme - Functionality: common questions
Does Porto Theme - Functionality have known vulnerabilities?
Yes. VulnCrest Radar lists 7 known vulnerabilities in Porto Theme - Functionality: 1 critical, 3 high, 3 medium. At least one is not fixed in the latest version.
How do I check which version of Porto Theme - Functionality I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Porto Theme - Functionality vulnerability?
CVE-2026-42415, published Oct 5, 2026: Porto Theme - Functionality <= 3.9.3 - Unauthenticated SQL Injection. Severity: High (CVSS 7.5).
Is any Porto Theme - Functionality vulnerability listed in CISA KEV?
No. None of the known Porto Theme - Functionality vulnerabilities is currently listed in the CISA KEV catalog.