CVE-2026-84815

MediumCVSS 5.8

Published: 03/09/2026(UTC)Updated: 03/09/2026(UTC)Translated: 03/09/2026(UTC)NVD NIST

Summary

The Enfold theme by Kriesi contains a reflected Cross-site Scripting vulnerability in versions up to and including 8.0. It stems from improper neutralization of input during web page generation.

Risk Assessment

An attacker can exploit reflected XSS to execute malicious scripts in the victim's browser, potentially leading to session theft, account takeover, or malware distribution.

Recommendation

Update the Enfold theme to the latest patched version and apply input/output sanitization to prevent XSS.

Other vulnerabilities in Enfold

CVE-2026-48869High
Versions of Enfold <= 7.1.4 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows Reflected XSS. This issue affects Enfold: from n/a through 8.0.