CVE-2026-28083
Stored XSS Vulnerability in Flatsome Theme
Publication date: 2026-02-26
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ux-themes | flatsome | to 3.20.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-28083 is a Cross Site Scripting (XSS) vulnerability affecting the WordPress Flatsome Theme versions up to and including 3.20.1.
This vulnerability is classified under the OWASP Top 10 category A3: Injection and has a CVSS severity score of 6.5, indicating a moderate risk level.
Exploitation requires user interaction by a privileged user with at least Contributor or Developer roles, who must perform an action such as clicking a malicious link, visiting a crafted page, or submitting a form.
Successful exploitation allows an attacker to inject malicious scripts—such as redirects, advertisements, or other HTML payloads—that execute when site visitors access the compromised website.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to inject malicious scripts into your website that execute when visitors access it.
- Injected scripts can perform redirects to malicious sites.
- Attackers can display unwanted advertisements.
- Other harmful HTML payloads can be executed, potentially compromising user experience and security.
However, exploitation requires a privileged user to interact with malicious content, which limits the risk.
No official patch is currently available, but mitigation services are offered by Patchstack.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves identifying attempts to exploit stored Cross-site Scripting (XSS) in the Flatsome WordPress theme versions up to 3.20.1. Since exploitation requires a privileged user to interact with malicious input, monitoring for unusual or suspicious input in web forms, URLs, or stored content is essential.
Specific commands are not provided in the available resources. However, general detection methods include reviewing web server logs for suspicious requests, scanning for injected scripts in stored content, and using web application security scanners that can detect XSS vulnerabilities.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting privileged user interactions to trusted users only, as exploitation requires a user with Contributor or Developer roles to perform actions such as clicking malicious links or submitting crafted forms.
Since no official patch is currently available, consider using mitigation services offered by Patchstack or implementing input sanitization and output encoding to neutralize malicious scripts.
Additionally, monitoring and limiting user-generated content and educating privileged users about the risks of interacting with untrusted content can reduce the risk of exploitation.