EUVD-2026-43374Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Reflected XSS is network-reachable with low complexity and no auth but needs a victim click (UI:R); script runs cross-context (S:C) with low C/I and no genuine availability impact (A:N).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UX-themes Flatsome flatsome allows Reflected XSS.This issue affects Flatsome: from n/a through <= 3.20.5.
AnalysisAI
Reflected cross-site scripting in the UX-themes Flatsome WordPress/WooCommerce theme (all versions up to and including 3.20.5) lets a remote attacker inject script that executes in a victim's browser when they click a crafted link. Reported by Patchstack with a CVSS 3.1 score of 7.1 (scope-changed, low-impact), the flaw requires user interaction but no authentication. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
The affected component is Flatsome, a commercial WordPress theme built primarily for WooCommerce storefronts (CPE cpe:2.3:a:ux-themes:flatsome). The root cause is CWE-79, Improper Neutralization of Input During Web Page Generation: user-controllable input (typically a request/URL parameter reflected in search results, error pages, or theme-generated markup) is echoed back into an HTML response without adequate output encoding or sanitization. Because this is reflected (not stored) XSS, the malicious payload is not persisted server-side; it is carried in the request and rendered inline in the immediate response, executing in the context of the vulnerable site's origin.
RemediationAI
Upgrade Flatsome to a release later than 3.20.5 as soon as the vendor (UX-themes) publishes a fixed version; the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/flatsome/vulnerability/wordpress-flatsome-theme-3-20-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve) is the authoritative reference and will note the patched build - no exact fixed version is confirmed in the provided data, so verify it against the vendor changelog before deploying. Until a patched theme is installed, deploy a WAF or virtual-patching rule (Patchstack and similar WordPress firewalls offer this) to filter XSS payloads targeting the reflecting parameter, which adds latency-free protection but can be bypassed by novel encodings. As a compensating control, restrict or monitor which URLs are handed to administrators and enforce a strict Content-Security-Policy that disallows inline script, which blunts reflected XSS execution but may break legitimate inline scripts in the theme or plugins and requires testing before rollout.
Deserialization of Untrusted Data vulnerability in UX-themes Flatsome | Multi-Purpose Responsive WooCommerce Theme.17.5.
Broken access control in the UX-Themes Flatsome WordPress theme (versions up to and including 3.20.5) allows remote unau
Broken access control in the Flatsome WordPress theme (versions <= 3.20.5) allows contributor-level authenticated users
The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the UX Countdown, Video Button, UX Vid
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
Insufficient authorization controls in Flatsome theme versions 3.19.6 and earlier allow unauthenticated remote attackers
Broken access control in Flatsome WordPress theme versions 3.20.5 and earlier allows authenticated subscriber-level user
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today