CVE-2026-84815: WordPress Enfold theme <= 8.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows Reflected XSS.
This issue affects Enfold: from n/a through 8.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Enfold Themeto a version that resolves this vulnerability.Fixed in 8.1
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attack is reflected XSS over the network and requires user interaction. No attacker privileges are required, but the high attack complexity indicates exploitation depends on conditions not described in the available data.
What impact could a successful attack have?
The supplied CVSS vector indicates low confidentiality, integrity, and availability impact, with scope changed. The available data does not specify the exact actions an attacker could perform in a victim’s browser.
Which Enfold versions should be considered affected?
Enfold versions through 8.0 are affected. The earliest affected version is not specified, so deployments running 8.0 or an earlier version should be treated as potentially vulnerable.