CVE-2026-18742: Flatsome <= 3.20.12 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-text-sec', 'data-title', and 'title' Attributes via Custom HTML Block
The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-text-sec', 'data-title', and 'title' Attributes via Custom HTML Block in all versions up to, and including, 3.20.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives server-side sanitization because wpksespost permits data- attributes globally via wpaddglobalattributes, allowing attacker-controlled values in data-text-sec, data-title, and title attributes to persist in saved post content and be later interpreted as HTML by the ux-countdown, scroll-to, and lightbox-gallery JavaScript behaviors.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with Contributor-level permissions or higher. They must be able to add a Custom HTML Block containing malicious values in the affected attributes.
When does the injected script execute?
The malicious content is stored in a page and executes when a user visits that injected page. The affected JavaScript behaviors are ux-countdown, scroll-to, and lightbox-gallery.
Why can the payload remain after WordPress sanitization?
The payload can survive because wp_kses_post permits data-* attributes globally through _wp_add_global_attributes. Attacker-controlled values in data-text-sec and data-title can therefore persist in saved post content.
Which versions are affected?
All Flatsome versions up to and including 3.20.12 are affected.