CVE-2025-8684: 
WordPress vulnerability analysis and mitigation

The Flatsome Theme for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2025-8684) affecting all versions up to and including 3.20.0. The vulnerability was disclosed on September 5, 2025, and stems from insufficient input sanitization and output escaping on user-supplied attributes in the theme's shortcodes (NVD CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) with a CVSS v3.1 base score of 6.4 (Medium). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L) and no user interaction (UI:N). The scope is changed (S:C) with low confidentiality (C:L) and integrity (I:L) impacts, and no availability impact (A:N) (NVD CVE).

The vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially leading to unauthorized data access, session hijacking, or other client-side attacks (NVD CVE).

Users should update the Flatsome Theme to a version newer than 3.20.0 once available. Until then, it is recommended to restrict contributor and author access to trusted users only (Wordfence Intel).