Theme security history

Flatsome Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 11 vulnerability records associated with Flatsome, published between 2023 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

11Total records

1Critical

0High

10Medium

0Low

0Informational

7Patched records

4Currently marked unpatched

2023-04-25First disclosure

2026-07-06Latest disclosure

11 of 11CVE coverage

Use this history

Check and watch Flatsome.

A history record does not establish whether the version installed on your website is affected. Enter the exact version in the checker, or add this software to a private Critical/High alert watchlist.

Check my installed version Watch Flatsome

Year-by-Year Timeline

Year	Records	Relative volume
2023	2	2 records
2024	3	3 records
2025	2	2 records
2026	4	4 records

Severity Breakdown

Severity	Records	Share
Critical	1	9.1%
Medium	10	90.9%

Vulnerability-Type Breakdown

Cross-Site Scripting

6 records54.5%

First: 2023. Latest: 2026.

Missing Authorization

4 records36.4%

First: 2024. Latest: 2026.

Other

1 record9.1%

First: 2023. Latest: 2023.

Patch Status

Patched: 7
Currently marked unpatched: 4
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

3.20.6
3.20.1
3.19.7
3.19.0
3.17.6
3.17.0

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-3.20.5`	Flatsome <= 3.20.5 - Missing Authorization	July 6, 2026	Not supplied	Medium
`*-3.20.5`	Flatsome <= 3.20.5 - Reflected Cross-Site Scripting	July 6, 2026	Not supplied	Medium
`*-3.20.5`	Flatsome <= 3.20.5 - Missing Authorization	July 1, 2026	Not supplied	Medium
`*-3.20.5`	Flatsome <= 3.20.5 - Missing Authorization	July 1, 2026	Not supplied	Medium
`*-3.20.5`	Flatsome <= 3.20.5 - Authenticated (Contributor+) Stored Cross-Site Scripting	October 6, 2025	3.20.6	Medium
`*-3.20.0`	Flatsome <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	September 4, 2025	3.20.1	Medium
`*-3.19.6`	Flatsome <= 3.19.6 - Missing Authorization	October 24, 2024	3.19.7	Medium
`*-3.18.7`	Flatsome \| Multi-Purpose Responsive WooCommerce Theme <= 3.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes	June 21, 2024	3.19.0	Medium
`*-3.18.7`	Flatsome <= 3.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	June 19, 2024	3.19.0	Medium
`*-3.17.5`	Flatsome <= 3.17.5 - Unauthenticated PHP Object Injection	September 5, 2023	3.17.6	Critical
`*-3.16.8`	Flatsome <= 3.16.8 - Reflected Cross-Site Scripting in UX Builder	April 25, 2023	3.17.0	Medium

Selected source records

Latest Records

MediumCVE-2026-57728

Flatsome <= 3.20.5 - Reflected Cross-Site Scripting

Published: July 6, 2026

Affected versions: *-3.20.5
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2026-57729

Flatsome <= 3.20.5 - Missing Authorization

Published: July 6, 2026

Affected versions: *-3.20.5
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2026-57730

Flatsome <= 3.20.5 - Missing Authorization

Published: July 1, 2026

Affected versions: *-3.20.5
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2026-57731

Flatsome <= 3.20.5 - Missing Authorization

Published: July 1, 2026

Affected versions: *-3.20.5
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2026-28083

Flatsome <= 3.20.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: October 6, 2025

Affected versions: *-3.20.5
Patched versions: 3.20.6

Original Wordfence record

MediumCVE-2025-8684

Flatsome <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published: September 4, 2025

Affected versions: *-3.20.0
Patched versions: 3.20.1

Original Wordfence record

MediumCVE-2026-31915

Flatsome <= 3.19.6 - Missing Authorization

Published: October 24, 2024

Affected versions: *-3.19.6
Patched versions: 3.19.7

Original Wordfence record

MediumCVE-2024-5346

Flatsome | Multi-Purpose Responsive WooCommerce Theme <= 3.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes

Published: June 21, 2024

Affected versions: *-3.18.7
Patched versions: 3.19.0

Original Wordfence record

Highest-Severity Records

CriticalCVE-2023-40555

Flatsome <= 3.17.5 - Unauthenticated PHP Object Injection

Published: September 5, 2023

Affected versions: *-3.17.5
Patched versions: 3.17.6

Original Wordfence record

MediumCVE-2024-5346

Flatsome | Multi-Purpose Responsive WooCommerce Theme <= 3.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes

Published: June 21, 2024

Affected versions: *-3.18.7
Patched versions: 3.19.0

Original Wordfence record

MediumCVE-2026-28083

Flatsome <= 3.20.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: October 6, 2025

Affected versions: *-3.20.5
Patched versions: 3.20.6

Original Wordfence record

MediumCVE-2024-5156

Flatsome <= 3.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published: June 19, 2024

Affected versions: *-3.18.7
Patched versions: 3.19.0

Original Wordfence record

MediumCVE-2025-8684

Flatsome <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published: September 4, 2025

Affected versions: *-3.20.0
Patched versions: 3.20.1

Original Wordfence record

MediumCVE-2023-28994

Flatsome <= 3.16.8 - Reflected Cross-Site Scripting in UX Builder

Published: April 25, 2023

Affected versions: *-3.16.8
Patched versions: 3.17.0

Original Wordfence record

MediumCVE-2026-57728

Flatsome <= 3.20.5 - Reflected Cross-Site Scripting

Published: July 6, 2026

Affected versions: *-3.20.5
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2026-31915

Flatsome <= 3.19.6 - Missing Authorization

Published: October 24, 2024

Affected versions: *-3.19.6
Patched versions: 3.19.7

Original Wordfence record

Currently Marked Unpatched Records

MediumCVE-2026-57728

Flatsome <= 3.20.5 - Reflected Cross-Site Scripting

Published: July 6, 2026

Affected versions: *-3.20.5
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2026-57729

Flatsome <= 3.20.5 - Missing Authorization

Published: July 6, 2026

Affected versions: *-3.20.5
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2026-57730

Flatsome <= 3.20.5 - Missing Authorization

Published: July 1, 2026

Affected versions: *-3.20.5
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2026-57731

Flatsome <= 3.20.5 - Missing Authorization

Published: July 1, 2026

Affected versions: *-3.20.5
Patched versions: Not supplied

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory