CVE-2026-48869: WordPress Enfold theme <= 7.1.4 - Reflected Cross Site Scripting (XSS) vulnerability

Q: Which installations are affected?

The affected product is the Kriesi Enfold WordPress theme at version 7.1.4 or earlier. The provided data does not identify any unaffected fixed version.

Q: Does an attacker need an account or special permissions?

No. The vulnerability is described as unauthenticated, and the vector indicates it can be reached over the network with low attack complexity.

Q: Is user interaction required for exploitation?

Yes. The CVSS vector includes UI:R, indicating that a user must interact with attacker-controlled content or a crafted request for exploitation to succeed.

Published Jun 16, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in Enfold <= 7.1.4 versions.

Affected Software

1 affected component

Kriesi Enfold (WordPress theme)<=7.1.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Enfold theme to a version that resolves this vulnerability.
Fixed in 7.1.5

Event History

Jun 16, 2026

CVE Published

via MITRE·08:57 PM

Data Sourced

via MITRE·08:57 PM

RemedyDescriptionSeverityWeakness

Jun 17, 2026

Data Sourced

via NVD·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

The affected product is the Kriesi Enfold WordPress theme at version 7.1.4 or earlier. The provided data does not identify any unaffected fixed version.

Does an attacker need an account or special permissions?

No. The vulnerability is described as unauthenticated, and the vector indicates it can be reached over the network with low attack complexity.

Is user interaction required for exploitation?

Yes. The CVSS vector includes UI:R, indicating that a user must interact with attacker-controlled content or a crafted request for exploitation to succeed.

CVE-2026-48869: WordPress Enfold theme <= 7.1.4 - Reflected Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

Does an attacker need an account or special permissions?

Is user interaction required for exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

Does an attacker need an account or special permissions?

Is user interaction required for exploitation?