CVE-2026-57728
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Flatsome plugin for WordPress contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. The issue affects versions up to and including 3.20.5.
Risk Assessment
An attacker can inject malicious JavaScript code into the page, potentially leading to session theft, redirects to malicious sites, or theft of sensitive data.
Recommendation
Immediately update the Flatsome plugin to the latest available version that includes a fix for this vulnerability.
Other vulnerabilities in Flatsome
See all- CVE-2026-57731Medium
The Flatsome plugin version 3.20.5 and earlier contains a broken access control vulnerability for contributors. A user with the contributor role can gain unauthorized access to functions or data that should be restricted.
- CVE-2026-57730Medium
The Flatsome plugin version 3.20.5 and earlier contains a broken access control vulnerability for subscribers. This allows unauthorized users with the subscriber role to access functions or data they should not have permissions for.
- CVE-2026-57729High
The Flatsome plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 3.20.5.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UX-themes Flatsome flatsome allows Reflected XSS.This issue affects Flatsome: from n/a through <= 3.20.5.