WordPress security by component

Phlox

Theme description

Phlox is a WordPress component with 2 published CVE records in this archive. The latest tracked vulnerability was published Jan 06, 2026; the highest CVE/CNA score is 6.4.

Theme slug: phlox

Latest vulnerability

CVE-2025-4776: Phlox: Cross-site scripting

Phlox is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

PublishedJan 06, 2026

Safe version guidanceSee mitigation notes

		Safe version
Jan 06, 2026	CVE-2025-4776 Phlox: Cross-site scripting Phlox is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVDPending
Aug 21, 2024	CVE-2024-6339 Phlox PRO: Cross-site scripting Phlox PRO is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.1 NVDPending