porto

porto has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; 2 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 8.2, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2024 was the busiest year with 2 disclosures.

The most common weakness is PHP Remote File Inclusion, behind 2 of the records (67%). Other recurring categories include Cross-Site Scripting.

2 of the records (67%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

2 independent researchers contributed these findings, most of them (2) reported by István Márton.

01234567891008.05.2024Today08.05.20248.8Porto <= 7.1.0 - Authenticated (Contributor+) Local File Inclusion via Post Meta CVSS 8.8 · 08.05.20249.8Porto <= 7.1.0 - Unauthenticated Local File Inclusion via porto_ajax_posts CVSS 9.8 · 08.05.202427.02.20266.1Porto <= 7.6.2 - Reflected Cross-Site Scripting CVSS 6.1 · 27.02.2026

Strategic Overview

Avg CVSSHigh
8.2/ 10
Patch Coverage67%
Open

1

Fixed

2

Get automatic notifications for all porto vulnerabilities before they are exploited.

Most severe open issueCVSS 6.1CVE-2026-28075

Porto <= 7.6.2 - Reflected Cross-Site Scripting

Read the full analysis

Vulnerability Records

3 records
Showing 1–3 of 3 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C