Executive brief
Flatsome is a popular WordPress theme used for building e-commerce and business websites. A security flaw allows attackers to trick users into clicking a malicious link that executes unauthorized code in their browser. This could lead to the theft of sensitive session information, unauthorized actions performed on behalf of an administrator, or the defacement of the website.
Technical details
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the UX-themes Flatsome theme for WordPress through version 3.20.5. The flaw stems from improper neutralization of user-supplied input during web page generation (CWE-79). An unauthenticated remote attacker can exploit this by sending a specially crafted link to a victim; if the victim (such as a site administrator) clicks the link, the malicious script is executed within the context of their browser session. This can result in session hijacking, unauthorized data access, or modification of site content. As of the advisory date, no official patch has been released.
Affected products
- UX-themes Flatsome <= 3.20.5
Timeline
- 2026-02-16: other: Vulnerability reported by researcher Bonds
- 2026-07-06: advisory: Initial advisory published by Patchstack
- 2026-07-13: disclosed: CVE published to NVD dataset