What is the CVSS score of CVE-2026-48869?

CVE-2026-48869 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Enfold WordPress Theme are affected by CVE-2026-48869?

The Enfold WordPress theme versions 7.1.4 and earlier contains a reflected cross-site scripting vulnerability that allows attackers to compromise authenticated user sessions through social…

How to fix or mitigate CVE-2026-48869?

Within 24 hours: Inventory all WordPress installations using Enfold theme and document their versions; contact Enfold vendor support to confirm patch availability and release timeline. Within 7 days: Deactivate or switch to an alternative theme across all vulnerable instances, or deploy temporary mitigations listed below; notify end-users to avoid clicking unfamiliar links to your WordPress sites. Within 30 days: Confirm all Enfold installations are either patched (when released) or replaced with alternative themes; audit access and error logs for exploitation attempts; reset authentication credentials for any accounts showing suspicious activity.

Enfold WordPress Theme CVE-2026-48869

EUVD-2026-37494 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-16 Patchstack

WordPress XSS Enfold Wordpress Theme Kriesi

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Reflected XSS over the web (AV:N/AC:L), no auth needed (PR:N) but victim must click (UI:R); script runs in the WordPress session, crossing scope (S:C) with Low C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:27 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Enfold <= 7.1.4 versions.

AnalysisAI

Reflected cross-site scripting in the Enfold WordPress theme versions up to and including 7.1.4 allows remote unauthenticated attackers to execute arbitrary JavaScript in a victim's browser when the user is lured into clicking a crafted link. The CVSS scope change (S:C) and Low impact across C/I/A indicate the injected script can affect components beyond the vulnerable theme component, typically the authenticated WordPress session. No public exploit identified at time of analysis, though Patchstack's disclosure provides enough detail for skilled researchers to reproduce.

Technical ContextAI

Enfold is a widely deployed commercial WordPress theme by Kriesi (CPE: cpe:2.3:a:kriesi:enfold) used on many business and portfolio sites. The flaw maps to CWE-79 (Improper Neutralization of Input During Web Page Generation), and the Patchstack reference explicitly classifies it as reflected XSS, meaning user-controllable input from a request parameter is echoed back into a rendered page without proper output encoding or sanitization. Because WordPress themes render content within the same origin as the admin/session cookies, any successful injection runs in the security context of the visiting user, including potentially logged-in administrators.

RemediationAI

Upstream fix available per Patchstack advisory; a released patched version is not independently confirmed in the provided data, so administrators should consult the Patchstack page (https://patchstack.com/database/wordpress/theme/enfold/vulnerability/wordpress-enfold-theme-7-1-4-reflected-cross-site-scripting-xss-vulnerability) and Kriesi/ThemeForest for the next Enfold release above 7.1.4 and upgrade promptly. Until upgraded, place the site behind a WAF with an XSS ruleset (Patchstack, Wordfence, Cloudflare) to filter reflected payloads, train administrators to avoid following untrusted links to their own site while logged in, and consider enforcing a restrictive Content-Security-Policy header that disallows inline script - noting CSP may break legitimate Enfold builder features that rely on inline JavaScript and requires testing before enforcement.