Vulnerabilities

TI-2024-12734 CVE-2024-13695 · GHSA-w426-8j83-72cm

Enfold <= 6.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery via attachment_id

LOW 28

The Enfold theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.9 via the 'attachment_id' parameter.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00256 Published 2025-02-25 No fix listed CWE-918

TI-2024-12732 CVE-2024-13693 · GHSA-p2vq-q8r6-6mg3

Enfold <= 6.0.9 - Missing Authorization to Sensitive Information Disclosure in avia-export-class.php

LOW 30

The Enfold theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check in avia-export-class.php in all versions up to, and including, 6.0.9.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00332 Published 2025-02-25 No fix listed CWE-284

TI-2024-04701 CVE-2024-5061 · GHSA-52j9-r8mv-933c

Enfold <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wrapper_class and class Parameters

LOW 28

The Enfold - Responsive Multi-Purpose Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wrapper_class’ and 'class' parameters in all versions up to, and including, 6.0.3 due to insufficient…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00263 Published 2024-08-30 No fix listed CWE-79

TI-2024-24715 CVE-2024-37199 · GHSA-7762-735r-r97m

WordPress Enfold theme <= 5.6.9 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kriesi.At Enfold allows Reflected XSS.This issue affects Enfold: from n/a through 5.6.9.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00288 Published 2024-07-22 No fix listed CWE-79

TI-2023-19784 CVE-2023-38400 · GHSA-mh5f-x36r-g76r

WordPress Enfold Theme <= 5.6.4 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold - Responsive Multi-Purpose Theme allows Reflected XSS.This issue affects Enfold - Responsive Multi-Purpo…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00403 Published 2023-11-30 No fix listed CWE-79

TI-2021-07001 CVE-2021-24719 · GHSA-476w-cp8h-fwc5

Enfold Theme < 4.8.4 - Reflected Cross-Site Scripting (XSS)

LOW 33

The Enfold Enfold WordPress theme before 4.8.4 was vulnerable to Reflected Cross-Site Scripting (XSS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02959 Published 2021-10-11 Fixed in 4.8.4 CWE-79

TI-2014-06080 CVE-2014-7297 · GHSA-v6fh-f9x6-866w

Unspecified vulnerability in the folder framework in the Enfold theme before 3.0.1 for…

MEDIUM 47

Unspecified vulnerability in the folder framework in the Enfold theme before 3.0.1 for WordPress has unknown impact and attack vectors.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.02101 Published 2014-10-13 No fix listed