Volto supports only the latest major version of Plone with security updates. See https://plone.org/security/update-policy.

If you found a possible vulnerability, please contact the Plone security team at security@plone.org.