CVE-2026-84815
MediumCVSS 5.8Summary
The Enfold theme by Kriesi contains a reflected Cross-site Scripting vulnerability in versions up to and including 8.0. It stems from improper neutralization of input during web page generation.
Risk Assessment
An attacker can exploit reflected XSS to execute malicious scripts in the victim's browser, potentially leading to session theft, account takeover, or malware distribution.
Recommendation
Update the Enfold theme to the latest patched version and apply input/output sanitization to prevent XSS.
Other vulnerabilities in Enfold
See all- CVE-2026-48869High
Versions of Enfold <= 7.1.4 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
- CVE-2025-66053Medium
The Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to improper neutralization of input during web page generation. This issue affects versions up to and including 7.1.2.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows Reflected XSS. This issue affects Enfold: from n/a through 8.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS