Enfold vulnerabilities

3 known CVE vulnerabilities in Enfold, translated and rated.

CVE-2026-84815Medium
The Enfold theme by Kriesi contains a reflected Cross-site Scripting vulnerability in versions up to and including 8.0. It stems from improper neutralization of input during web page generation.
CVE-2026-48869High
Versions of Enfold <= 7.1.4 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
CVE-2025-66053Medium
The Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to improper neutralization of input during web page generation. This issue affects versions up to and including 7.1.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS