PT-2024-27881

Name of the Vulnerable Software and Affected Versions Porto theme for WordPress versions up to and including 7.1.0 Description The issue allows unauthenticated attackers to include and execute arbitrary files on the server via the porto ajax posts function, enabling the execution of any PHP code ...

PT-2024-27882

Name of the Vulnerable Software and Affected Versions Porto theme for WordPress versions up to and including 7.1.0 Description The issue allows authenticated attackers with contributor-level and above permissions to include and execute arbitrary files on the server. This is achieved via the porto...

PT-2024-27886

Name of the Vulnerable Software and Affected Versions The Porto Theme - Functionality plugin for WordPress versions prior to 3.0.10 Description The issue allows authenticated attackers with contributor-level and above permissions to include and execute arbitrary files on the server via the...

PT-2024-27883

Name of the Vulnerable Software and Affected Versions The Porto Theme - Functionality plugin for WordPress versions up to, and including, 3.1.0 Description The issue allows authenticated attackers with contributor-level and above permissions to include and execute arbitrary files on the server vi...

Porto < 7.1.1 - Unauthenticated Local File Inclusion via porto_ajax_posts

Description The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via the 'portoajaxposts' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any P...

Porto < 7.1.1 - Authenticated (Contributor+) Local File Inclusion via Post Meta

Description The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via 'portopageheadershortcodetype', 'slideshowtype' and 'postlayout' post meta. This makes it possible for authenticated attackers, with contributor-level and above...

Porto Theme - Functionality < 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Post Meta

Description The Porto Theme - Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.9 via the 'slideshowtype' post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and...

CVE-2023-48738

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Porto Theme Porto Theme - Functionality.This issue affects Porto Theme - Functionality: from n/a before 2.12.1...

CVE-2023-48738

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Porto Theme Porto Theme - Functionality.This issue affects Porto Theme - Functionality: from n/a before 2.12.1...

Sql injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Porto Theme Porto Theme - Functionality.This issue affects Porto Theme - Functionality: from n/a before 2.12.1...

CVE-2023-48738 WordPress Porto Theme - Functionality Plugin < 2.12.1 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Porto Theme Porto Theme - Functionality.This issue affects Porto Theme - Functionality: from n/a before 2.12.1...

CVE-2023-48738

CVE-2023-48738 affects the Porto Theme – Functionality plugin for WordPress. The vulnerability is an SQL Injection caused by improper neutralization of specific elements, exploitable by an unauthenticated attacker. The issue applies to Porto Theme – Functionality versions before 2.12.1. Impact is...

CVE-2023-48738 WordPress Porto Theme - Functionality Plugin < 2.12.1 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Porto Theme Porto Theme - Functionality.This issue affects Porto Theme - Functionality: from n/a before 2.12.1...

WordPress Theme Porto SQL Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in...

PT-2023-30930 · Unknown · The Porto Theme

Name of the Vulnerable Software and Affected Versions: Porto Theme - Functionality versions prior to 2.12.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This could allow an unauthenticated attacker t...

CVE-2023-48738: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Porto Theme Porto Theme - Functionality.This issue affects Porto Theme - Functionality: from n/a before 2.12.1...

Porto Theme - Functionality < 2.12.1 - Missing Authorization

Description The Porto Theme - Functionality plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on an unknown function in versions up to, and including, 2.11.1. This makes it possible for unauthenticated attackers to perform an unauthorized...

Porto Theme - Functionality < 2.12.1 - Unauthenticated SQL Injection

Description The Porto Theme - Functionality plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.11.1 due to insufficient escaping on a user supplied parameter and lack of sufficient preparation on an existing SQL query. This makes it possible for unauthenticate...

WordPress Porto Theme - Functionality Plugin < 2.12.1 is vulnerable to Broken Access Control

Software Porto Theme - Functionality Type Plugin Vulnerable versions 2.12.1 Fixed in 2.12.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-48739 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID aa73939ac882 Credits Rafie...

WordPress Porto Theme - Functionality Plugin < 2.12.1 is vulnerable to SQL Injection

Software Porto Theme - Functionality Type Plugin Vulnerable versions 2.12.1 Fixed in 2.12.1 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-48738 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 5a7e2b4a3331 Credits Rafie Muhammad Patchstack Required...