CVE-2026-48869
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Versions of Enfold <= 7.1.4 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
Risk Assessment
This vulnerability may lead to user data theft and session hijacking, posing a significant threat to the application's security and its users.
Recommendation
It is recommended to update to the latest version of Enfold to mitigate this vulnerability and conduct a security audit of the application.
Other vulnerabilities in Enfold
See all- CVE-2026-84815Medium
The Enfold theme by Kriesi contains a reflected Cross-site Scripting vulnerability in versions up to and including 8.0. It stems from improper neutralization of input during web page generation.
- CVE-2025-66053Medium
The Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to improper neutralization of input during web page generation. This issue affects versions up to and including 7.1.2.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Enfold <= 7.1.4 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS