Phlox

Phlox has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Phlox has a vendor fix available, so running the current release closes it.

All of these findings were reported by Webbernaut. Phlox is installed on roughly 30,000 WordPress sites, so each unpatched flaw has a wide blast radius.

Strategic Overview

Avg CVSSMedium

6.4/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Phlox vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2025-4776

Phlox <= 2.17.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-caption` HTML Attribute

Read the full analysis

Vulnerability Records

1 records


2026-01-05 17:35	Phlox <= 2.17.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-caption` HTML Attribute Phlox <= 2.17.7	`CVE-2025-4776`	6.4 Medium	Webbernaut	Yes

Showing 1–1 of 1 reports

Latestv2.17.22

Phlox

Author

averta

4.8(866)

96/100

Last Updated

2026-08-01 (1mo ago)

Active Installs

30,000+

Downloads

1,771,793

Requires WP

Requires PHP

7.0+

Created

2017-07-31 (9y ago)

Phlox is a modern, lightweight and customizable theme perfect for almost any type of website including, blog, portfolio, business, agency, news & magazine, food & restaurant, travel, and photography as well as WooCommerce storefront. What makes the Phlox unbeatable is being fast, truly responsive, translation ready, RTL layout, built with SEO in mind, professional portfolio features, 30 exclusive widgets and elements, 19 demo sites for one-click import, WooCommerce Ready, WPML ready, 100% GDPR compliance, reliable with regular updates, and also integrated with Elementor, Visual Composer and SiteOrigin page builders. Phlox is architect from scratch by the team behind the famous "Master Slider" project, so relax and be assured that you are supported by a good company. Phlox is the only theme that you have ever need to use and look no further. Start exploring the demos: http://demo.phlox.pro/default/