Porto Theme - Functionality vulnerabilities

Unauthenticated SQL Injection vulnerability in Porto Theme - Functionality versions up to 3.9.3. An attacker can execute unauthorized database queries.

The Porto Theme - Functionality plugin versions below 3.7.3 have a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The Porto Theme - Functionality plugin (versions below 3.7.3) contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in the user's browser.