Roseta
Roseta has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it remains unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Roseta has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2024.
All of these findings were reported by stealthcopter. Roseta is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius.
CVE-2024-45451Roseta <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Roseta
Author
CryoutCreations
A fast, clean and highly customizable theme. It's beautiful and multi-purpose - use it for your blog, online portfolio, business website or WooCommerce store. It's lightweight, mobile friendly and responsive, created with SEO in mind (taking full advantage of microformats and Schema.org microdata that search engines love). Some of the amazing features include: Responsive / WooCommerce / RTL / Translation Ready / Google Fonts / Gutenberg support / Regular updates. Some of the many customizable aspects include: Layouts (Wide and Boxed) / Site widths / Header elements / Featured images / Colors / Post metas / Widgets areas / Landing page elements / Slider / Typography / Masonry bricks / Socials and much more. Still not convinced? Check out the theme demo: https://demos.cryoutcreations.eu/wp/roseta
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C