Stored Cross-Site Scripting in Flatsome Theme for WordPress

CVE-2025-8684

What is CVE-2025-8684?

The Flatsome Theme for WordPress has a vulnerability that allows authenticated attackers with contributor-level access and above to execute arbitrary scripts through stored cross-site scripting (XSS). This issue arises from insufficient sanitization of user inputs and inadequate output escaping of attributes in the theme's shortcodes. Consequently, when a page containing the malicious script is accessed, the user's browser may execute it, potentially compromising sensitive user data or leading to further site exploitation.

References