Kriesi Enfold
10 CVEs affecting Kriesi Enfold. Latest disclosed: 2026-06-17. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48869 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Enfold <= 7.1.4 versions. |
CVE-2024-37199 | High | 7.1 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kriesi.At Enfold allows Reflected XSS.This issue a… |
CVE-2023-38400 | High | 7.1 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold - Responsive Multi-Purpose Theme allows Ref… |
CVE-2025-68900 | Medium | 6.5 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows DOM-Based XSS. This issue affects E… |
CVE-2025-66053 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold enfold allows Stored XSS.This issue affects… |
CVE-2024-13695 | Medium | 6.4 | 2025-02-25 | The Enfold theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.9 via the 'attachment_id' parameter. This… |
CVE-2024-5061 | Medium | 6.4 | 2024-08-30 | The Enfold - Responsive Multi-Purpose Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wrapper_class’ and 'class' parameters in… |
CVE-2021-24719 | Medium | 6.1 | 2021-10-11 | The Enfold Enfold WordPress theme before 4.8.4 was vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability is present on Enfold versions previous… |
CVE-2024-13693 | Medium | 5.3 | 2025-02-25 | The Enfold theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check in avia-export-class.php in all versions up to, a… |
CVE-2014-7297 | | 2014-10-13 | Unspecified vulnerability in the folder framework in the Enfold theme before 3.0.1 for WordPress has unknown impact and attack vectors. |