WordPress security by component
Flatsome
Theme description
Flatsome is a WordPress component with 11 published CVE records in this archive. The latest tracked vulnerability was published Jul 13, 2026; the highest CVE/CNA score is 8.3.
Theme slug:
flatsomeLatest vulnerability
CVE-2026-57729: Flatsome: A security weakness
Flatsome is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 3.20.5.
| Safe version |
|
||
|---|---|---|---|
| Jul 13, 2026 |
CVE-2026-57729
Flatsome: A security weakness
Flatsome is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 3.20.5.
|
> 3.20.5 |
CVE7.5
NVDPending
|
| Jul 13, 2026 |
CVE-2026-57728
Flatsome: Cross-site scripting
Flatsome is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 3.20.5.
|
> 3.20.5 |
CVE7.1
NVDPending
|
| Jul 02, 2026 |
CVE-2026-57731
Flatsome: A security weakness
Flatsome is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 3.20.5.
|
> 3.20.5 |
CVE6.5
NVDPending
|
| Jul 02, 2026 |
CVE-2026-57730
Flatsome: A security weakness
Flatsome is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 3.20.5.
|
> 3.20.5 |
CVE4.3
NVDPending
|
| Mar 13, 2026 |
CVE-2026-31915
Flatsome: A security weakness
Flatsome is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Feb 26, 2026 |
CVE-2026-28083
Flatsome: Cross-site scripting
Flatsome is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVDPending
|
| Sep 05, 2025 |
CVE-2025-8684
Flatsome: Cross-site scripting
Flatsome is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVDPending
|
| Jun 22, 2024 |
CVE-2024-5346
Flatsome: Cross-site scripting
Flatsome is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Jun 20, 2024 |
CVE-2024-5156
Flatsome: Cross-site scripting
Flatsome is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVDPending
|
| Dec 20, 2023 |
CVE-2023-40555
Flatsome | Multi-Purpose Responsive WooCommerce Theme: Code execution
Flatsome | Multi-Purpose Responsive WooCommerce Theme is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE8.3
NVD9.8
|
| Aug 23, 2023 |
CVE-2023-28994
Flatsome: Cross-site scripting
Flatsome is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE7.1
NVD6.1
|