CVE-2025-66053: WordPress Enfold theme <= 7.1.2 - Cross Site Scripting (XSS) vulnerability
Published Nov 21, 2025
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold enfold allows Stored XSS.This issue affects Enfold: from n/a through <= 7.1.2.
Affected Software
2 affected components
Kriesi Enfold<=7.1.2
WordPress Enfold theme<=7.1.2
Event History
Nov 21, 2025
CVE Published
via MITRE·12:29 PM
Data Sourced
via MITRE·12:29 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-66053?
CVE-2025-66053 is classified as a critical severity vulnerability due to its potential for Stored XSS attacks.
2
How do I fix CVE-2025-66053?
To remediate CVE-2025-66053, update the Kriesi Enfold theme to version 7.1.3 or later.
3
Which versions of the Enfold theme are affected by CVE-2025-66053?
CVE-2025-66053 affects Kriesi Enfold versions up to and including 7.1.2.
4
What type of vulnerability is CVE-2025-66053?
CVE-2025-66053 is an Improper Neutralization of Input During Web Page Generation vulnerability, also known as Cross-site Scripting (XSS).
5
Who is affected by CVE-2025-66053?
Users of the Kriesi Enfold theme for WordPress who are running versions 7.1.2 or earlier are affected by CVE-2025-66053.