The Enfold theme has a stored cross‑site scripting flaw that arises from improper neutralization of user input when generating web pages. The vulnerability allows an attacker to inject malicious scripts that persist in the website’s content and execute in the browsers of visitors. This can compromise confidentiality, integrity, or availability of the affected site, potentially leading to cookie theft, session hijacking, defacement, or distribution of malware.

The flaw is present in all Kriesi Enfold theme versions from the earliest releases up through 7.1.2. WordPress sites that deploy this theme, regardless of the WordPress core version, are vulnerable.

The CVSS score of 6.5 indicates medium severity, while an EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not registered in the CISA KEV database. The likely attack vector requires an authenticated user or a user with input privileges within the theme, and the attacker can exploit the field that stores user‐supplied data in a way that is subsequently rendered without proper escaping.