Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows Reflected XSS.

This issue affects Enfold: from n/a through 8.0.
Published: 2026-09-03
Score: 5.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: User‑facing Cross‑site Scripting that executes arbitrary scripts in the victim’s browser
Action: Apply Patch
AI Analysis

Impact

The vulnerability is an improper neutralization of input during web page generation, which leads to a reflected XSS flaw in the Kriesi Enfold WordPress theme. An attacker can deliver a crafted URL or payload that is included unfiltered into a web page, allowing the execution of arbitrary JavaScript within the victim’s browser context.

Affected Systems

All installations of the Kriesi Enfold WordPress theme from the initial version up to and including 8.0 are affected. Sites that have not updated beyond 8.0 are vulnerable.

Risk and Exploitability

The CVSS base score of 5.8 indicates moderate severity. No EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a crafted URL and can be performed by an unauthenticated user, making it a remote, client‑side attack that relies on reflected input.

Generated by OpenCVE AI on September 3, 2026 at 15:07 UTC.

Remediation

Vendor Solution

Update the WordPress Enfold Theme to the latest available version (at least 8.1).

OpenCVE Recommended Actions

  • Update the Enfold theme to version 8.1 or newer, following the vendor’s recommendation.
  • Remove all older Enfold theme files from the server to prevent accidental loading of vulnerable code.
  • Implement a Content Security Policy that restricts script execution to trusted origins, reducing the impact of any remaining XSS code execution.

Generated by OpenCVE AI on September 3, 2026 at 15:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 03 Sep 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Kriesi
Kriesi enfold
Wordpress
Wordpress wordpress
Vendors & Products Kriesi
Kriesi enfold
Wordpress
Wordpress wordpress

Thu, 03 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 03 Sep 2026 13:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows Reflected XSS. This issue affects Enfold: from n/a through 8.0.
Title WordPress Enfold theme <= 8.0 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 5.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Kriesi Enfold
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-09-03T13:50:07.824Z

Reserved: 2026-09-02T10:29:50.811Z

Link: CVE-2026-84815

cve-icon Vulnrichment

Updated: 2026-09-03T13:50:04.024Z

cve-icon NVD

Status : Deferred

Published: 2026-09-03T14:17:03.530

Modified: 2026-09-03T17:25:25.113

Link: CVE-2026-84815

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T15:15:05Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')