Flatsome

Flatsome has 11 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; 7 are fixed and 4 remain unpatched as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high. 2026 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 6 of the records (55%). Other recurring categories include Missing Authorization, Deserialization Of Untrusted Data.

7 of the records (64%) have a vendor fix, while 4 remain unpatched. The oldest unresolved one dates back to 2026.

6 independent researchers contributed these findings, most of them (4) reported by Bonds.

Strategic Overview

Avg CVSSMedium

6.1/ 10

Patch Coverage64%

Open

Fixed

Get automatic notifications for all Flatsome vulnerabilities before they are exploited.

Most severe open issueCVSS 6.1CVE-2026-57728

Flatsome <= 3.20.5 - Reflected Cross-Site Scripting

Read the full analysis

Vulnerability Records

11 records


2026-07-06 00:00	Flatsome <= 3.20.5 - Reflected Cross-Site Scripting Flatsome <= 3.20.5	`CVE-2026-57728`	6.1 Medium	Bonds	No
2026-07-06 00:00	Flatsome <= 3.20.5 - Missing Authorization Flatsome <= 3.20.5	`CVE-2026-57729`	5.3 Medium	Bonds	No
2026-07-01 00:00	Flatsome <= 3.20.5 - Missing Authorization Flatsome <= 3.20.5	`CVE-2026-57730`	4.3 Medium	Bonds	No
2026-07-01 00:00	Flatsome <= 3.20.5 - Missing Authorization Flatsome <= 3.20.5	`CVE-2026-57731`	4.3 Medium	Bonds	No
2025-10-06 00:00	Flatsome <= 3.20.5 - Authenticated (Contributor+) Stored Cross-Site Scripting Flatsome <= 3.20.5	`CVE-2026-28083`	6.4 Medium	João Pedro Soares de Alcântara	Yes
2025-09-04 14:54	Flatsome <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Flatsome <= 3.20.0	`CVE-2025-8684`	6.4 Medium	stealthcopter	Yes
2024-10-24 00:00	Flatsome <= 3.19.6 - Missing Authorization Flatsome <= 3.19.6	`CVE-2026-31915`	5.3 Medium	Ananda Dhakal	Yes
2024-06-21 13:15	Flatsome \| Multi-Purpose Responsive WooCommerce Theme <= 3.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes Flatsome <= 3.18.7	`CVE-2024-5346`	6.4 Medium	wesley (wcraft)	Yes
2024-06-19 00:00	Flatsome <= 3.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Flatsome <= 3.18.7	`CVE-2024-5156`	6.4 Medium	stealthcopter	Yes
2023-09-05 00:00	Flatsome <= 3.17.5 - Unauthenticated PHP Object Injection Flatsome <= 3.17.5	`CVE-2023-40555`	9.8 Critical	Rafie Muhammad	Yes

Showing 1–10 of 11 reports