CVE-2026-57728 UX-themes CVE debrief

Who should care

Users of Flatsome theme version 3.20.5 or earlier should apply updates to prevent Reflected XSS attacks. This includes site administrators, security teams, and anyone responsible for maintaining WordPress installations with the Flatsome theme. Additionally, users who have already updated to version 3.20.5 or later should verify that their installations are not vulnerable to other types of attacks.

Technical summary

The vulnerability, known as CVE-2026-57728, allows attackers to inject malicious scripts into web pages viewed by other users. This issue arises from improper neutralization of input during web page generation. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 7.1, indicating a High severity level. The vulnerability affects Flatsome versions from n/a through 3.20.5.

Defensive priority

High priority should be given to updating Flatsome to a version beyond 3.20.5 to mitigate Reflected XSS risks.

Recommended defensive actions

• Update Flatsome theme to a version beyond 3.20.5
• Monitor for suspicious web traffic and user input
• Implement Web Application Firewall (WAF) rules to detect XSS patterns
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence is limited; primary official records indicate a Reflected XSS vulnerability in Flatsome versions up to 3.20.5. Further verification is recommended. The CVE record was published on 2026-07-13T10:16:39.540Z and has not been modified since then. Additional review of vendor documentation and security advisories may be necessary to fully understand the vulnerability and its impact.

Official resources