CVE-2025-63066
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Porto Theme - Functionality plugin (versions below 3.7.3) contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in the user's browser.
Risk Assessment
An attacker could inject a persistent malicious script that executes in the browsers of site visitors or administrators. This may lead to session theft, account takeover, or website content modification.
Recommendation
Update the Porto Theme - Functionality plugin to version 3.7.3 or later. Also check the site content for any injected malicious scripts.
Other vulnerabilities in Porto Theme - Functionality
See all- CVE-2026-42415Critical
Unauthenticated SQL Injection vulnerability in Porto Theme - Functionality versions up to 3.9.3. An attacker can execute unauthorized database queries.
- CVE-2025-63067Medium
The Porto Theme - Functionality plugin versions below 3.7.3 have a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in p-themes Porto Theme - Functionality porto-functionality allows Stored XSS.This issue affects Porto Theme - Functionality: from n/a through < 3.7.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS