CVE-2026-66673

HighCVSS 7.1

Published: 20/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Summary

Unauthenticated Cross Site Scripting (XSS) vulnerability in Flatastic theme versions up to 2.0. An attacker without authentication can inject a malicious script into the page, which executes in the victim's browser.

Risk Assessment

Risk of user data theft, session hijacking, or malware distribution through the injected script.

Recommendation

Update the Flatastic theme to the latest version that includes a fix eliminating the XSS vulnerability.

Other vulnerabilities in Flatastic

CVE-2026-66672Critical
Unauthenticated PHP Object Injection vulnerability in Flatastic versions up to 2.0. An attacker can send crafted data to execute arbitrary code.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.