Stored Cross-Site Scripting Vulnerability in Flatsome Theme by UX Themes

CVE-2026-18742

What is CVE-2026-18742?

The Flatsome theme for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can exploit this flaw via the 'data-text-sec', 'data-title', and 'title' attributes within the Custom HTML Block. This vulnerability allows malicious scripts to be injected into pages, which can execute when users access the compromised content. The danger is amplified as the inserted payloads can evade server-side filtering mechanisms, allowing them to persist in stored content and be later rendered as HTML through specific JavaScript functionalities.

References