The vulnerability is a stored cross‑site scripting flaw in the Porto Theme – Functionality WordPress plugin. An unauthenticated web attacker can inject arbitrary script payloads that are saved to the site’s database. When other users load pages processed by the plugin, the malicious script executes in their browsers, potentially stealing cookies, session tokens or redirecting the user, thereby compromising confidentiality and integrity of client sessions. This weakness is a classic Cross‑Site Scripting (CWE‑79) flaw that can be leveraged for phishing, session hijacking or malicious code execution.

All WordPress installations that use the Porto Theme – Functionality plugin with a version less than 3.7.3 are impacted. The vulnerability is documented for the p‑themes:Porto Theme – Functionality product and applies to every release before 3.7.3.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1 % signals that exploit attempts are infrequent. The flaw is not listed in the CISA KEV catalog. The likely attack vector is via the web interface that accepts visitor input—an unauthenticated attacker can inject and store malicious code without logging in. Successful exploitation would compromise the browsers of any users who view affected pages, enabling client‑side attacks such as data theft or session hijack.