theme
17 known security issues reported for the Flatsome WordPress theme. Most recent disclosed Jul 6, 2026.
Running Flatsome on your site? Check whether your installed version is affected.
Scan your site freeThe Flatsome theme for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.20.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick...
The Flatsome theme for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.20.5. This makes it possible for unauthenticated attackers to perform an unauthorized action.
The Flatsome theme for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.20.5. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.
The Flatsome theme for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.20.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UX-themes Flatsome flatsome allows Stored XSS.This issue affects Flatsome: from n/a through <= 3.20.1.
The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.20.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wi...
The Flatsome Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's shortcodes in all versions up to, and including, 3.20.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access...
The Flatsome theme for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.19.6. This makes it possible for unauthenticated attackers to perform an unauthorized action.
[en] The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the UX Countdown, Video Button, UX Video, UX Slider, UX Sidebar, and UX Payment Icons shortcodes in all versions up to, and including, 3.18.7 due to insufficient input sanitization and output escaping on user supplied attributes. Thi...
The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the UX Countdown, Video Button, UX Video, UX Slider, UX Sidebar, and UX Payment Icons shortcodes in all versions up to, and including, 3.18.7 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...
[en] The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.18.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level...
The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.18.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level acce...
[en] Deserialization of Untrusted Data vulnerability in UX-themes Flatsome | Multi-Purpose Responsive WooCommerce Theme.This issue affects Flatsome | Multi-Purpose Responsive WooCommerce Theme: from n/a through 3.17.5.
The Flatsome theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.17.5 via deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow...
[en] Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in UX-themes Flatsome plugin <= 3.16.8 versions.
The Flatsome theme for WordPress is vulnerable to Reflected Cross-Site Scripting in the UX Builder in versions up to, and including, 3.16.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can s...
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free