UX Flat

UX Flat has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; 1 is fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 6.9, and the most serious one scores 7.4 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).

1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

2 independent researchers contributed these findings, one record each. UX Flat is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.

01234567891030.09.2022Today19.03.20247.4UX Flat <= 4.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 7.4 · 19.03.202420.01.20266.4UX Flat <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 20.01.2026

Strategic Overview

Avg CVSSMedium
6.9/ 10
Patch Coverage50%
Open

1

Fixed

1

Get automatic notifications for all UX Flat vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2026-24576

UX Flat <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records
Showing 1–2 of 2 reports
UX Flat banner
Latestv5.4.0

UX Flat

COP

Author

COP

4.7(13)
94/100
Last Updated
2025-06-29 (1y ago)
Active Installs
1,000+
Downloads
26,271
Requires WP
6.2+
Requires PHP
7.4+
Tested up to
WP 6.7.7
Created
2022-09-30 (4y ago)

❤ This plugin will create new elements for Flatsome. Awesome !!! Minimum required Flatsome v3.19.2 LOADER IMAGE ✅ Site Loader overlay when loading the site TYPING ANIMATION ✅ Change the search multiple field placeholder [UXF ELEMENTS] PRE-DESIGNED TEMPLATES ✅ Section / Banner / Title / Button / Gallery / Slider / Image / Blog Posts / Portfolio / Google Maps ✅ Blog Categories / More / Menu / Icon / Lightbox / Table / Module FL ICONS ✅ Enable customize icons BACK TO TOP ✅ Custom Background & Icon back to top BLOG GLOBAL ✅ Remove Category Archives Title PERFORMANCE ✅ Blog Categories ✅ CDN jsDelivr and more…

View on WordPress.org

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C