Astra

Astra has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 3 are fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.4 out of 10. 2024 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (100%).

Every one of the 3 issues recorded for Astra has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, one record each. Astra is installed on roughly 1,000,000 WordPress sites, so each unpatched flaw has a wide blast radius.

Strategic Overview

Avg CVSSMedium

6.1/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Astra vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2026-3534

Astra <= 4.12.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta

Read the full analysis

Vulnerability Records

3 records


2026-03-10 17:27	Astra <= 4.12.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Astra <= 4.12.3	`CVE-2026-3534`	6.4 Medium	at1as	Yes
2024-03-25 00:00	Astra <= 4.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting via Theme Header/Footer Astra <= 4.6.4	`CVE-2024-29768`	5.5 Medium	SavPhill (Savphill)	Yes
2024-03-25 00:00	Astra <= 4.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name Astra <= 4.6.8	`CVE-2024-2347`	6.4 Medium	stealthcopter	Yes

Showing 1–3 of 3 reports

Latestv4.13.11

Astra

Author

Brainstorm Force

4.9(6,524)

98/100

Last Updated

2026-09-08 (5d ago)

Active Installs

1,000,000+

Downloads

26,138,758

Requires WP

5.3+

Requires PHP

5.3+

Created

2017-05-30 (9y ago)

The Astra WordPress theme is lightning-fast and highly customizable. It has over 1 million downloads and the only theme in the world with 6,000+ five-star reviews! It’s ideal for professional web designers, solopreneurs, small businesses, eCommerce, membership sites and any type of website. It offers special features and templates so it works perfectly with all page builders like Spectra, Elementor, Beaver Builder, etc. Fast performance, clean code, mobile-first design and schema markup are all built-in, making the theme exceptionally SEO-friendly. It’s fully compatible with WooCommerce, SureCart and other eCommerce plugins and comes with lots of store-friendly features and templates. Astra also provides expert support for free users. A dedicated team of fully trained WordPress experts are on hand to help with every aspect of the theme. Try the live demo of Astra: https://zipwp.org/themes/astra/