CVE-2025-68900: WordPress Enfold theme <= 7.1.3 - Cross Site Scripting (XSS) vulnerability
Published Jan 22, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows DOM-Based XSS.
This issue affects Enfold: from n/a through 7.1.3.
Affected Software
1 affected component
Kriesi Enfold<=7.1.3
Remediation
Information
Update the WordPress Enfold theme to the latest available version (at least 7.1.4).
Event History
Jan 22, 2026
CVE Published
via MITRE·04:52 PM
Data Sourced
via MITRE·04:52 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·05:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-68900?
CVE-2025-68900 has been classified as a medium severity Cross Site Scripting (XSS) vulnerability.
2
How do I fix CVE-2025-68900?
To fix CVE-2025-68900, you should update the Enfold theme to a version higher than 7.1.3.
3
What specific type of vulnerability is CVE-2025-68900?
CVE-2025-68900 is a Cross Site Scripting (XSS) vulnerability caused by improper input neutralization in the Enfold theme.
4
What versions of Enfold are affected by CVE-2025-68900?
CVE-2025-68900 affects the Enfold theme versions from n/a up to and including 7.1.3.
5
Is CVE-2025-68900 exploitable by attackers?
Yes, CVE-2025-68900 is exploitable by attackers for executing malicious scripts in the user's browser through the Enfold theme.