CVE-2026-48869: WordPress Enfold theme <= 7.1.4 - Reflected Cross Site Scripting (XSS) vulnerability

Synopsis

Reflected cross-site scripting (XSS) affects the Enfold WordPress theme at version 7.1.4 and earlier. An unauthenticated remote attacker can deliver a crafted URL to a victim; when the victim clicks it, malicious JavaScript executes in their browser under the theme's origin. Successful exploitation allows the attacker to read session cookies, inject content into the page, or disrupt the user's browsing session. No upstream fix has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment a fix version is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to deliver a crafted URL to the victim over the network, meaning the WordPress site running Enfold must be reachable and the payload is reflected through an HTTP request.

• AuthenticationNot required

  No account or session credential is needed; the attacker can craft a malicious URL without any prior authentication to the WordPress installation.

• Victim interactionRequired

  The victim must click or otherwise open the attacker-supplied URL, making this a social-engineering vector that requires the target user to trigger the reflected payload.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim clicks the link; no race condition, memory layout dependency, or special environmental state is required.

Blast Radius

• Reads session cookies and authentication tokens stored in the victim's browser, potentially giving the attacker access to the victim's WordPress account.
• Injects arbitrary HTML or JavaScript into the page the victim sees, enabling phishing content or credential-harvesting forms to appear on the legitimate site.
• Performs actions on the WordPress site on behalf of the victim using their active session, such as modifying profile data or submitting forms.
• Disrupts the victim's browsing session by redirecting them to attacker-controlled pages or rendering the page non-functional.