CVE-2025-8684: Flatsome WordPress Theme XSS Vulnerability

CVE-2025-8684 Overview

CVE-2025-8684 is a Stored Cross-Site Scripting (XSS) vulnerability in the Flatsome Theme for WordPress. The flaw affects all versions up to and including 3.20.0 and stems from insufficient input sanitization and output escaping on user-supplied attributes within the theme's shortcodes. Authenticated attackers with contributor-level access or above can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any visitor who accesses the affected page. The weakness is classified under CWE-79.

Critical Impact
Contributor-level accounts can persistently inject JavaScript that executes in the context of site visitors and administrators, enabling session theft, account takeover, and further compromise of WordPress installations.

Affected Products

Flatsome Theme for WordPress — all versions up to and including 3.20.0
WordPress sites using vulnerable Flatsome shortcodes
WooCommerce storefronts built on the Flatsome multipurpose theme

Discovery Timeline

2025-09-05 - CVE-2025-8684 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8684

Vulnerability Analysis

The Flatsome theme exposes a rich set of shortcodes that accept user-supplied attributes to render UI elements such as banners, buttons, and content blocks. The theme processes these attributes without applying sufficient sanitization on input or escaping on output. An authenticated user with contributor privileges can craft a shortcode where an attribute value contains HTML or JavaScript payloads. When WordPress renders the containing post or page, the malicious payload is emitted directly into the DOM and executed by the visitor's browser.

Because the payload is stored in the post content, exploitation is persistent. Every viewer of the affected page triggers the script, including administrators previewing or reviewing contributor submissions. Successful exploitation can lead to session hijacking, forced administrative actions via CSRF chaining, redirection to malicious sites, and injection of cryptomining or credential-harvesting code.

Root Cause

The root cause is missing or inadequate sanitization on shortcode attribute values combined with the absence of output escaping when those attributes are rendered into HTML. WordPress functions such as esc_attr(), esc_html(), esc_url(), and wp_kses() are the standard defenses for this class of issue, and their omission or misuse allows attacker-controlled markup to survive intact through the rendering pipeline.

Attack Vector

Exploitation requires an authenticated account with contributor privileges or higher on a WordPress site running a vulnerable Flatsome version. The attacker inserts a Flatsome shortcode into a post or page draft, embedding a malicious event handler or <script> payload within one of the shortcode's accepted attributes. When the content is rendered — whether during editorial review, preview, or on the published page — the browser executes the injected script in the origin of the WordPress site.

Refer to the Wordfence Vulnerability Report for additional technical detail on the affected shortcode handlers.

Detection Methods for CVE-2025-8684

Indicators of Compromise

Post or page content containing Flatsome shortcodes with attributes holding <script>, javascript:, onerror=, onload=, or similar event handler payloads.
Unexpected outbound requests from visitor browsers to attacker-controlled domains originating from pages built with Flatsome.
New or modified posts authored by contributor-level accounts that include unusual HTML or encoded characters inside shortcode attributes.

Detection Strategies

Audit the wp_posts table for shortcode patterns that include suspicious attribute content or HTML/JavaScript syntax within shortcode boundaries.
Review web server access logs for anomalous requests to pages authored by low-privilege users, especially requests generating unusual referer chains.
Correlate WordPress user activity logs with post revision history to identify contributors who added or modified shortcodes shortly before suspicious client-side behavior was observed.

Monitoring Recommendations

Deploy a web application firewall with WordPress-aware rules that flag XSS payloads within shortcode attributes.
Enable Content Security Policy (CSP) headers restricting inline script execution and reporting violations to a monitored endpoint.
Continuously monitor the site for new plugin, theme, and content changes and alert on shortcode edits performed by non-editorial accounts.

How to Mitigate CVE-2025-8684

Immediate Actions Required

Update the Flatsome theme to a version later than 3.20.0 as published in the ThemeForest Flatsome Changelog.
Audit all contributor, author, and editor accounts; disable or reset credentials for any account that is inactive or unrecognized.
Review recent post revisions for injected shortcode payloads and purge malicious content from the database.

Patch Information

The theme vendor has published fixed releases addressing the shortcode sanitization gap. Administrators should apply the latest Flatsome update through the WordPress admin console or the Envato Market plugin, then flush any page or object caches to ensure sanitized output is served. Consult the ThemeForest Flatsome Changelog for the specific fixed version.

Workarounds

Restrict contributor and author roles until the theme is patched, or temporarily elevate publishing workflows to require editor review before content is rendered.
Deploy a WAF rule that blocks HTML tags and JavaScript URI schemes inside Flatsome shortcode attribute values.
Apply a strict Content Security Policy that disallows inline scripts and untrusted script sources to reduce the impact of stored payloads.

bash

# Example restrictive CSP header for NGINX in front of WordPress
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;