Flatsome

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Themes   >   Flatsome

Information

Software Type Theme
Software Slug flatsome
Software Status Active
Software Author UX-themes
Software Website themeforest.net
Software Active Installs 254,654
Software Record Last Updated April 28, 2025

11 Vulnerabilities

Submit a Vulnerability
Flatsome <= 3.20.5 - Missing Authorization
5.3
CVE-2026-57729
Jul 6, 2026
Researcher: Bonds
Flatsome <= 3.20.5 - Reflected Cross-Site Scripting
6.1
CVE-2026-57728
Jul 6, 2026
Researcher: Bonds
Flatsome <= 3.20.5 - Missing Authorization
4.3
CVE-2026-57730
Jul 1, 2026
Researcher: Bonds
Flatsome <= 3.20.5 - Missing Authorization
4.3
CVE-2026-57731
Jul 1, 2026
Researcher: Bonds
Flatsome <= 3.20.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-28083
Oct 6, 2025
Researcher: João Pedro Soares de Alcântara
Flatsome <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2025-8684
Sep 4, 2025
Researcher: stealthcopter
Flatsome <= 3.19.6 - Missing Authorization
5.3
CVE-2026-31915
Oct 24, 2024
Researcher: Ananda Dhakal
Flatsome | Multi-Purpose Responsive WooCommerce Theme <= 3.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
6.4
CVE-2024-5346
Jun 21, 2024
Researcher: wesley (wcraft)
Flatsome <= 3.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2024-5156
Jun 19, 2024
Researcher: stealthcopter
Flatsome <= 3.17.5 - Unauthenticated PHP Object Injection
9.8
CVE-2023-40555
Sep 5, 2023
Researcher: Rafie Muhammad
Flatsome <= 3.16.8 - Reflected Cross-Site Scripting in UX Builder
6.1
CVE-2023-28994
Apr 25, 2023
Researcher: Rafie Muhammad
Title Status CVE ID CVSS Researchers Date
Flatsome <= 3.20.5 - Missing Authorization Unpatched CVE-2026-57729 5.3 Bonds July 6, 2026
Flatsome <= 3.20.5 - Reflected Cross-Site Scripting Unpatched CVE-2026-57728 6.1 Bonds July 6, 2026
Flatsome <= 3.20.5 - Missing Authorization Unpatched CVE-2026-57730 4.3 Bonds July 1, 2026
Flatsome <= 3.20.5 - Missing Authorization Unpatched CVE-2026-57731 4.3 Bonds July 1, 2026
Flatsome <= 3.20.5 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2026-28083 6.4 João Pedro Soares de Alcântara October 6, 2025
Flatsome <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Patched CVE-2025-8684 6.4 stealthcopter September 4, 2025
Flatsome <= 3.19.6 - Missing Authorization Patched CVE-2026-31915 5.3 Ananda Dhakal October 24, 2024
Flatsome | Multi-Purpose Responsive WooCommerce Theme <= 3.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes Patched CVE-2024-5346 6.4 wesley (wcraft) June 21, 2024
Flatsome <= 3.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Patched CVE-2024-5156 6.4 stealthcopter June 19, 2024
Flatsome <= 3.17.5 - Unauthenticated PHP Object Injection Patched CVE-2023-40555 9.8 Rafie Muhammad September 5, 2023
Flatsome <= 3.16.8 - Reflected Cross-Site Scripting in UX Builder Patched CVE-2023-28994 6.1 Rafie Muhammad April 25, 2023

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation