CVE-2025-66053
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to improper neutralization of input during web page generation. This issue affects versions up to and including 7.1.2.
Risk Assessment
An attacker may store malicious scripts that execute in the browsers of users visiting infected pages, potentially leading to session hijacking.
Recommendation
Update the Enfold plugin to a version later than 7.1.2.
Other vulnerabilities in Enfold
See all- CVE-2026-84815Medium
The Enfold theme by Kriesi contains a reflected Cross-site Scripting vulnerability in versions up to and including 8.0. It stems from improper neutralization of input during web page generation.
- CVE-2026-48869High
Versions of Enfold <= 7.1.4 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold enfold allows Stored XSS.This issue affects Enfold: from n/a through <= 7.1.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS