PLUGIN SECURITY
Known vulnerabilities, PHP compatibility and safer alternatives for the Porto Functionality WordPress plugin — checked against WP Clinic's local security database.
porto-functionality6 known CVEs on file for Porto Functionality. Reported between 2023 and 2025.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2025-63067 | Porto Functionality [porto-functionality] < 3.7.3 | Missing Authorization | Medium 4.3 | < 3.7.3 | 3.7.3 | 2025-10-12 | — |
| CVE-2025-63066 | Porto Functionality [porto-functionality] < 3.7.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 3.7.3 | 3.7.3 | 2025-10-11 | — |
| CVE-2024-3809 | Porto Functionality [porto-functionality] < 3.1.0 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | High 8.8 | < 3.1.0 | 3.1.0 | 2024-05-08 | — |
| CVE-2024-3808 | Porto Functionality [porto-functionality] < 3.1.1 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | High 8.8 | < 3.1.1 | 3.1.1 | 2024-05-08 | — |
| CVE-2023-48739 | Porto Functionality [porto-functionality] < 2.12.1 | Missing Authorization | Medium 5.3 | < 2.12.1 | 2.12.1 | 2023-11-23 | — |
| CVE-2023-48738 | Porto Functionality [porto-functionality] < 2.12.1 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.3 | < 2.12.1 | 2.12.1 | 2023-11-23 | — |
The Porto Theme - Functionality plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and excluding, 3.7.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
Source: Wordfence
The Porto Theme - Functionality plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and excluding, 3.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Source: Wordfence
The Porto Theme - Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.9 via the 'slideshow_type' post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
Source: CVE.org
The Porto Theme - Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.0 via the 'porto_portfolios' shortcode 'portfolio_layout' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
Source: CVE.org
No patched version is available. Rafie Muhammad (Patchstack) discovered and reported this Broken Access Control vulnerability in WordPress Porto Theme - Functionality Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has not been known to be fixed yet.
Source: Patchstack
The Porto Theme - Functionality plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.11.1 due to insufficient escaping on a user supplied parameter and lack of sufficient preparation on an existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Source: Wordfence
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.