Reflected XSS Vulnerability in Enfold Theme by Kriesi
CVE-2026-84815

5.8MEDIUM

Key Information:

Vendor

WordPress
Status
Enfold
Vendor
CVE Published:
3 September 2026

What is CVE-2026-84815?

A reflected cross-site scripting (XSS) vulnerability exists in the Enfold theme developed by Kriesi. This flaw can be exploited by attackers to inject malicious scripts into web pages that are viewed by unsuspecting users. If successfully executed, this vulnerability can lead to session hijacking, defacement, or the unauthorized capture of sensitive information. The issue affects versions of Enfold from n/a up to 8.0, highlighting the importance of keeping your WordPress themes updated to mitigate potential exploits.

Affected Version(s)

Enfold <= 8.0

References

https://patchstack.com/database/wordpress/theme/enfold/vu...
vdb-entry

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafie Muhammad | Patchstack Bug Bounty Program
.