Crete: attractive portfolio theme, but not worth the security risk

Crete looks better than its long-term ownership case. It is a portfolio and creative-agency theme built around Elementor, with WooCommerce compatibility, four header layouts, sticky-header controls, one-click demo importing, a child-theme generator, Contact Form 7 compatibility, translation support, and several prebuilt personal and agency layouts. For a freelancer who wants to reproduce the demo quickly, the visual starting point is genuinely useful.

The theme is also more flexible than a basic brochure theme. Elementor works with the free version according to the developer’s support replies, so you do not automatically need Elementor Pro. WooCommerce support gives the theme room to grow into a small shop, and the changelog shows practical fixes such as PHP 8.2 compatibility, demo-import repairs, translation options, breadcrumb controls, RTL support, and CSS fixes. The official listing also includes six months of author support with the regular purchase.

That is the good news. The problem is that Crete’s setup experience appears more dependent on author assistance than the sales page suggests. Buyers have reported that demo imports stop at roughly 4–5 percent and loop, that the full demo from Envato Elements does not import, and that pages visible in one demo are not available after importing another. The developer’s answer in those cases is to open a support ticket or provide site access so the team can import pages manually. Another buyer said the documentation appeared to belong to a different theme. That is not fatal for an experienced developer, but it is frustrating for beginners expecting a straightforward starter site.

Crete also has an awkward maintenance profile. The ThemeForest listing says it was last updated on November 7, 2024, identifies WordPress 6.2.x as the newest tested software version, and explicitly says it is not Gutenberg optimized. That does not prove it cannot run on newer WordPress releases, but it does mean the compatibility claim is dated. The theme’s design is tied closely to Elementor and its companion functionality, which makes switching themes later more involved than starting with a lightweight multipurpose theme.

The decisive issue is security. Crete Core, the companion plugin associated with the theme, has a publicly recorded unauthenticated blind SQL-injection vulnerability affecting versions through 1.4.3. Wordfence lists the issue as unpatched, while vulnerability databases describe the potential impact as unauthorized extraction of sensitive database information. Do not install an affected Crete Core version on a public site; if you already use Crete, check the installed plugin version immediately and deactivate it until you can verify a fixed release. ([wordfence.com](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/crete-core?utm_source=openai))

Compared with Astra, Kadence, GeneratePress, or Hello Elementor, Crete offers a more finished visual identity but a narrower and riskier technical base. Those alternatives let you build a similar portfolio with Elementor or the block editor without committing your site’s core presentation to an aging theme framework and questionable companion-plugin history. Verdict: avoid Crete for new projects. Keep it only when replacing an existing site would cost more than the design is worth and you can actively audit every bundled component.